xmrig | 023dcfc4a502e188fdf8553b6f273cf2a7d058e03333ac634c61fd3142d639c8

Analysis

max time kernel
133s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
Size 1.5MB
Sample240602-2e8geshd5v
SHA256 023dcfc4a502e188fdf8553b6f273cf2a7d058e03333ac634c61fd3142d639c8
MD5 7721e9825202bfb16882fc593f23f800
SHA1 c66bd8f9024c5a6d06b694b28e47f965d972db53
SHA512 206cd8a6eadd32cad67ee92d84091323a70ea67848b6450fd37da0029d1e14516efd8aadfc0cb90572180bdca9239225be5bbaacef66cdac1a048082a0fbbf0c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEC:Lz071uv4BPMkFfdg6NsXX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/4068-251-0x00007FF7F7BB0000-0x00007FF7F7FA2000-memory.dmp	xmrig
behavioral2/memory/3992-907-0x00007FF742A70000-0x00007FF742E62000-memory.dmp	xmrig
behavioral2/memory/412-1118-0x00007FF7F89A0000-0x00007FF7F8D92000-memory.dmp	xmrig
behavioral2/memory/4424-736-0x00007FF6B2EC0000-0x00007FF6B32B2000-memory.dmp	xmrig
behavioral2/memory/1400-1773-0x00007FF72E440000-0x00007FF72E832000-memory.dmp	xmrig
behavioral2/memory/3056-2074-0x00007FF792CA0000-0x00007FF793092000-memory.dmp	xmrig
behavioral2/memory/4568-1684-0x00007FF79C380000-0x00007FF79C772000-memory.dmp	xmrig
behavioral2/memory/2580-2080-0x00007FF681730000-0x00007FF681B22000-memory.dmp	xmrig
behavioral2/memory/2352-1375-0x00007FF651C70000-0x00007FF652062000-memory.dmp	xmrig
behavioral2/memory/4296-2088-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp	xmrig
behavioral2/memory/876-2087-0x00007FF7992C0000-0x00007FF7996B2000-memory.dmp	xmrig
behavioral2/memory/1524-593-0x00007FF74FFD0000-0x00007FF7503C2000-memory.dmp	xmrig
behavioral2/memory/836-439-0x00007FF7BECE0000-0x00007FF7BF0D2000-memory.dmp	xmrig
behavioral2/memory/1984-380-0x00007FF6CEC70000-0x00007FF6CF062000-memory.dmp	xmrig
behavioral2/memory/5084-344-0x00007FF7D94F0000-0x00007FF7D98E2000-memory.dmp	xmrig
behavioral2/memory/316-252-0x00007FF6F0F50000-0x00007FF6F1342000-memory.dmp	xmrig
behavioral2/memory/3676-250-0x00007FF610A50000-0x00007FF610E42000-memory.dmp	xmrig
behavioral2/memory/3320-249-0x00007FF7A7EB0000-0x00007FF7A82A2000-memory.dmp	xmrig
behavioral2/memory/3560-248-0x00007FF772270000-0x00007FF772662000-memory.dmp	xmrig
behavioral2/memory/2572-247-0x00007FF6E3900000-0x00007FF6E3CF2000-memory.dmp	xmrig
behavioral2/memory/556-43-0x00007FF66EF30000-0x00007FF66F322000-memory.dmp	xmrig
behavioral2/memory/628-3707-0x00007FF6DAFD0000-0x00007FF6DB3C2000-memory.dmp	xmrig
behavioral2/memory/3560-3709-0x00007FF772270000-0x00007FF772662000-memory.dmp	xmrig
behavioral2/memory/556-3711-0x00007FF66EF30000-0x00007FF66F322000-memory.dmp	xmrig
behavioral2/memory/392-3713-0x00007FF61A340000-0x00007FF61A732000-memory.dmp	xmrig
behavioral2/memory/3320-3716-0x00007FF7A7EB0000-0x00007FF7A82A2000-memory.dmp	xmrig
behavioral2/memory/2580-3717-0x00007FF681730000-0x00007FF681B22000-memory.dmp	xmrig
behavioral2/memory/5084-3719-0x00007FF7D94F0000-0x00007FF7D98E2000-memory.dmp	xmrig
behavioral2/memory/4296-3734-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp	xmrig
behavioral2/memory/3676-3735-0x00007FF610A50000-0x00007FF610E42000-memory.dmp	xmrig
behavioral2/memory/876-3732-0x00007FF7992C0000-0x00007FF7996B2000-memory.dmp	xmrig
behavioral2/memory/1524-3729-0x00007FF74FFD0000-0x00007FF7503C2000-memory.dmp	xmrig
behavioral2/memory/836-3727-0x00007FF7BECE0000-0x00007FF7BF0D2000-memory.dmp	xmrig
behavioral2/memory/2352-3725-0x00007FF651C70000-0x00007FF652062000-memory.dmp	xmrig
behavioral2/memory/316-3722-0x00007FF6F0F50000-0x00007FF6F1342000-memory.dmp	xmrig
behavioral2/memory/3056-3737-0x00007FF792CA0000-0x00007FF793092000-memory.dmp	xmrig
behavioral2/memory/4568-3743-0x00007FF79C380000-0x00007FF79C772000-memory.dmp	xmrig
behavioral2/memory/4424-3745-0x00007FF6B2EC0000-0x00007FF6B32B2000-memory.dmp	xmrig
behavioral2/memory/4068-3739-0x00007FF7F7BB0000-0x00007FF7F7FA2000-memory.dmp	xmrig
behavioral2/memory/2572-3741-0x00007FF6E3900000-0x00007FF6E3CF2000-memory.dmp	xmrig
behavioral2/memory/412-3763-0x00007FF7F89A0000-0x00007FF7F8D92000-memory.dmp	xmrig
behavioral2/memory/2712-3759-0x00007FF6CB240000-0x00007FF6CB632000-memory.dmp	xmrig
behavioral2/memory/3992-3753-0x00007FF742A70000-0x00007FF742E62000-memory.dmp	xmrig
behavioral2/memory/1400-3757-0x00007FF72E440000-0x00007FF72E832000-memory.dmp	xmrig
behavioral2/memory/1984-3751-0x00007FF6CEC70000-0x00007FF6CF062000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1732	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
628	QCoryly.exe
556	yXgBtAY.exe
392	isFvqRY.exe
2572	CwQlvor.exe
3560	sQyoKBT.exe
2580	yaaijiT.exe
876	ICHyVpz.exe
3320	nBNahjC.exe
3676	DKdViRl.exe
4068	hMhJPHj.exe
316	XMHRpLR.exe
5084	iVcmrWa.exe
1984	doVjXaF.exe
836	koNCUcx.exe
4296	nigovLN.exe
1524	sIkELlj.exe
4424	BmevJel.exe
3992	mvezDos.exe
412	pGyrIbo.exe
2352	tLjPvdE.exe
4568	MTUnxhm.exe
2712	XuRZHTm.exe
1400	lXSjIND.exe
3056	nMwSsSR.exe
2760	iUerNlT.exe
4728	WqqSUXQ.exe
4396	sRnoSXM.exe
4852	wLKVqOV.exe
1192	MwgxwmI.exe
2576	DFLJesm.exe
4620	XYifwgJ.exe
1416	WJCVSGM.exe
2668	UqhyowB.exe
2028	PHcoqbH.exe
4784	zqwVrLf.exe
4008	OaNEYTc.exe
4152	dnelsUv.exe
3048	rkKCTbF.exe
1992	aulFLBa.exe
1392	WsGjXzl.exe
3448	tOjbOmu.exe
2032	dlDpbKk.exe
4680	JhbyObU.exe
5044	XvjeVDn.exe
528	NNmdkHT.exe
2468	uHJrOEe.exe
3508	tMZcNWq.exe
3988	ImuvVES.exe
1776	OCtsFCi.exe
2452	uzIwzeI.exe
212	mrSZyuL.exe
3652	MrfYISo.exe
1620	bYEmhWJ.exe
2644	fRzlYmN.exe
5008	UICkCHS.exe
3380	KYGaLjy.exe
4532	fbsWiYI.exe
4892	QOvPwcX.exe
4420	ntJroYs.exe
2880	rvffSLt.exe
4084	SqXuZLg.exe
1676	kpDhTTl.exe
1988	wktqRCV.exe
3476	HthTGGm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3444-0-0x00007FF719DE0000-0x00007FF71A1D2000-memory.dmp	upx
behavioral2/files/0x0009000000023437-5.dat	upx
behavioral2/files/0x0007000000023441-7.dat	upx
behavioral2/memory/628-11-0x00007FF6DAFD0000-0x00007FF6DB3C2000-memory.dmp	upx
behavioral2/files/0x000700000002344a-56.dat	upx
behavioral2/files/0x000700000002344f-88.dat	upx
behavioral2/files/0x0007000000023449-54.dat	upx
behavioral2/files/0x0007000000023455-205.dat	upx
behavioral2/memory/4068-251-0x00007FF7F7BB0000-0x00007FF7F7FA2000-memory.dmp	upx
behavioral2/memory/3992-907-0x00007FF742A70000-0x00007FF742E62000-memory.dmp	upx
behavioral2/memory/412-1118-0x00007FF7F89A0000-0x00007FF7F8D92000-memory.dmp	upx
behavioral2/memory/4424-736-0x00007FF6B2EC0000-0x00007FF6B32B2000-memory.dmp	upx
behavioral2/memory/1400-1773-0x00007FF72E440000-0x00007FF72E832000-memory.dmp	upx
behavioral2/memory/3056-2074-0x00007FF792CA0000-0x00007FF793092000-memory.dmp	upx
behavioral2/memory/4568-1684-0x00007FF79C380000-0x00007FF79C772000-memory.dmp	upx
behavioral2/memory/2580-2080-0x00007FF681730000-0x00007FF681B22000-memory.dmp	upx
behavioral2/memory/2352-1375-0x00007FF651C70000-0x00007FF652062000-memory.dmp	upx
behavioral2/memory/4296-2088-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp	upx
behavioral2/memory/876-2087-0x00007FF7992C0000-0x00007FF7996B2000-memory.dmp	upx
behavioral2/memory/1524-593-0x00007FF74FFD0000-0x00007FF7503C2000-memory.dmp	upx
behavioral2/memory/836-439-0x00007FF7BECE0000-0x00007FF7BF0D2000-memory.dmp	upx
behavioral2/memory/1984-380-0x00007FF6CEC70000-0x00007FF6CF062000-memory.dmp	upx
behavioral2/memory/5084-344-0x00007FF7D94F0000-0x00007FF7D98E2000-memory.dmp	upx
behavioral2/memory/316-252-0x00007FF6F0F50000-0x00007FF6F1342000-memory.dmp	upx
behavioral2/memory/3676-250-0x00007FF610A50000-0x00007FF610E42000-memory.dmp	upx
behavioral2/memory/3320-249-0x00007FF7A7EB0000-0x00007FF7A82A2000-memory.dmp	upx
behavioral2/memory/3560-248-0x00007FF772270000-0x00007FF772662000-memory.dmp	upx
behavioral2/memory/2572-247-0x00007FF6E3900000-0x00007FF6E3CF2000-memory.dmp	upx
behavioral2/files/0x0007000000023462-204.dat	upx
behavioral2/files/0x0007000000023461-203.dat	upx
behavioral2/files/0x0007000000023458-188.dat	upx
behavioral2/files/0x0007000000023460-185.dat	upx
behavioral2/files/0x0007000000023450-184.dat	upx
behavioral2/files/0x000700000002345e-166.dat	upx
behavioral2/files/0x0007000000023454-159.dat	upx
behavioral2/files/0x0007000000023456-156.dat	upx
behavioral2/files/0x000700000002345d-154.dat	upx
behavioral2/files/0x000700000002345b-148.dat	upx
behavioral2/files/0x000700000002345c-145.dat	upx
behavioral2/files/0x000a000000023438-141.dat	upx
behavioral2/files/0x000700000002345a-140.dat	upx
behavioral2/files/0x0007000000023453-135.dat	upx
behavioral2/files/0x0007000000023451-134.dat	upx
behavioral2/files/0x000700000002344b-131.dat	upx
behavioral2/files/0x000700000002345f-181.dat	upx
behavioral2/files/0x000700000002344e-120.dat	upx
behavioral2/files/0x000700000002344d-109.dat	upx
behavioral2/files/0x000700000002344c-108.dat	upx
behavioral2/files/0x0007000000023459-107.dat	upx
behavioral2/files/0x0007000000023448-103.dat	upx
behavioral2/files/0x0007000000023457-102.dat	upx
behavioral2/files/0x0007000000023447-100.dat	upx
behavioral2/files/0x0007000000023452-98.dat	upx
behavioral2/files/0x0007000000023445-97.dat	upx
behavioral2/files/0x0007000000023442-87.dat	upx
behavioral2/files/0x0007000000023440-81.dat	upx
behavioral2/files/0x0007000000023446-76.dat	upx
behavioral2/memory/392-69-0x00007FF61A340000-0x00007FF61A732000-memory.dmp	upx
behavioral2/files/0x0007000000023444-66.dat	upx
behavioral2/memory/556-43-0x00007FF66EF30000-0x00007FF66F322000-memory.dmp	upx
behavioral2/files/0x0007000000023443-36.dat	upx
behavioral2/memory/628-3707-0x00007FF6DAFD0000-0x00007FF6DB3C2000-memory.dmp	upx
behavioral2/memory/3560-3709-0x00007FF772270000-0x00007FF772662000-memory.dmp	upx
behavioral2/memory/556-3711-0x00007FF66EF30000-0x00007FF66F322000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DUsVfOW.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\mrPYVDj.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\wbXAjpJ.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\uIwBmGO.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\tSKDDSY.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\yDSKKGN.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\APAzOsl.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\PoCqxxm.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\LXezYtS.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\xIWEgTY.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\EwFCdEo.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\yiyTHrf.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\vbwrcfc.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\GGofxEy.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\peZmpdV.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\gTSepwU.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\gLmfeOM.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\XLKFrRz.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\NoWGhaa.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\UeyttMd.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\ESXSlCa.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\SDSSzUZ.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\tLlWQxS.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\TeyCmOf.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\UxuBnEu.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\IjBCVkn.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\sLPZMeF.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\fligTAA.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\pEtYXwI.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\qWRdNya.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\AtTiuDk.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\XpMfLnd.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\PELvmDh.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\VNudGCK.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\KtLcQvS.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\NSdlSZF.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\MrfYISo.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\tbmjQvW.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\iFdIMHw.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\mAxMbaJ.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\sEwSOvB.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\shygYkM.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\xUZbzef.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\dwpDZlZ.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\kkbibdp.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\vEbJSVK.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\RKcUWQT.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\MuhByhb.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\hjlBSNW.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\dnvmabB.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\jbDCqkL.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\SQNKPaZ.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\exCZiMy.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\vptdkdB.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\zPuwLwW.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\wKedslR.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\ELFrhBv.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\jeqWABu.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\guOqMxV.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\ihXJBkA.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\rwPgmbQ.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\BhpGkZC.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\Ddtnaue.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
File created	C:\Windows\System\GuSYWCr.exe	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1732	powershell.exe
1732	powershell.exe
1732	powershell.exe
1732	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
Token: SeDebugPrivilege	1732	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 1732	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	84
PID 3444 wrote to memory of 1732	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	84
PID 3444 wrote to memory of 628	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	85
PID 3444 wrote to memory of 628	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	85
PID 3444 wrote to memory of 392	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	86
PID 3444 wrote to memory of 392	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	86
PID 3444 wrote to memory of 556	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	87
PID 3444 wrote to memory of 556	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	87
PID 3444 wrote to memory of 2572	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	88
PID 3444 wrote to memory of 2572	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	88
PID 3444 wrote to memory of 3560	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	89
PID 3444 wrote to memory of 3560	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	89
PID 3444 wrote to memory of 2580	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	90
PID 3444 wrote to memory of 2580	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	90
PID 3444 wrote to memory of 876	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	91
PID 3444 wrote to memory of 876	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	91
PID 3444 wrote to memory of 3320	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	92
PID 3444 wrote to memory of 3320	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	92
PID 3444 wrote to memory of 3676	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	93
PID 3444 wrote to memory of 3676	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	93
PID 3444 wrote to memory of 4068	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	94
PID 3444 wrote to memory of 4068	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	94
PID 3444 wrote to memory of 316	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	95
PID 3444 wrote to memory of 316	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	95
PID 3444 wrote to memory of 5084	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	96
PID 3444 wrote to memory of 5084	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	96
PID 3444 wrote to memory of 1984	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	97
PID 3444 wrote to memory of 1984	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	97
PID 3444 wrote to memory of 836	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	98
PID 3444 wrote to memory of 836	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	98
PID 3444 wrote to memory of 4296	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	99
PID 3444 wrote to memory of 4296	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	99
PID 3444 wrote to memory of 1524	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	100
PID 3444 wrote to memory of 1524	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	100
PID 3444 wrote to memory of 4424	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	101
PID 3444 wrote to memory of 4424	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	101
PID 3444 wrote to memory of 3992	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	102
PID 3444 wrote to memory of 3992	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	102
PID 3444 wrote to memory of 412	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	103
PID 3444 wrote to memory of 412	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	103
PID 3444 wrote to memory of 1400	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	104
PID 3444 wrote to memory of 1400	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	104
PID 3444 wrote to memory of 2352	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	105
PID 3444 wrote to memory of 2352	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	105
PID 3444 wrote to memory of 4568	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	106
PID 3444 wrote to memory of 4568	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	106
PID 3444 wrote to memory of 2712	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	107
PID 3444 wrote to memory of 2712	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	107
PID 3444 wrote to memory of 3056	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	108
PID 3444 wrote to memory of 3056	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	108
PID 3444 wrote to memory of 2760	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	109
PID 3444 wrote to memory of 2760	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	109
PID 3444 wrote to memory of 4728	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	110
PID 3444 wrote to memory of 4728	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	110
PID 3444 wrote to memory of 4396	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	111
PID 3444 wrote to memory of 4396	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	111
PID 3444 wrote to memory of 4852	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	112
PID 3444 wrote to memory of 4852	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	112
PID 3444 wrote to memory of 1192	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	113
PID 3444 wrote to memory of 1192	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	113
PID 3444 wrote to memory of 2576	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	114
PID 3444 wrote to memory of 2576	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	114
PID 3444 wrote to memory of 4620	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	115
PID 3444 wrote to memory of 4620	3444	7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7721e9825202bfb16882fc593f23f800_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\System\QCoryly.exe
  C:\Windows\System\QCoryly.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\isFvqRY.exe
  C:\Windows\System\isFvqRY.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\yXgBtAY.exe
  C:\Windows\System\yXgBtAY.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\CwQlvor.exe
  C:\Windows\System\CwQlvor.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\sQyoKBT.exe
  C:\Windows\System\sQyoKBT.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\yaaijiT.exe
  C:\Windows\System\yaaijiT.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\ICHyVpz.exe
  C:\Windows\System\ICHyVpz.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\nBNahjC.exe
  C:\Windows\System\nBNahjC.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\DKdViRl.exe
  C:\Windows\System\DKdViRl.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\hMhJPHj.exe
  C:\Windows\System\hMhJPHj.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\XMHRpLR.exe
  C:\Windows\System\XMHRpLR.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\iVcmrWa.exe
  C:\Windows\System\iVcmrWa.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\doVjXaF.exe
  C:\Windows\System\doVjXaF.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\koNCUcx.exe
  C:\Windows\System\koNCUcx.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\nigovLN.exe
  C:\Windows\System\nigovLN.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\sIkELlj.exe
  C:\Windows\System\sIkELlj.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\BmevJel.exe
  C:\Windows\System\BmevJel.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\mvezDos.exe
  C:\Windows\System\mvezDos.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\pGyrIbo.exe
  C:\Windows\System\pGyrIbo.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\lXSjIND.exe
  C:\Windows\System\lXSjIND.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\tLjPvdE.exe
  C:\Windows\System\tLjPvdE.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\MTUnxhm.exe
  C:\Windows\System\MTUnxhm.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\XuRZHTm.exe
  C:\Windows\System\XuRZHTm.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\nMwSsSR.exe
  C:\Windows\System\nMwSsSR.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\iUerNlT.exe
  C:\Windows\System\iUerNlT.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\WqqSUXQ.exe
  C:\Windows\System\WqqSUXQ.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\sRnoSXM.exe
  C:\Windows\System\sRnoSXM.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\wLKVqOV.exe
  C:\Windows\System\wLKVqOV.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\MwgxwmI.exe
  C:\Windows\System\MwgxwmI.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\DFLJesm.exe
  C:\Windows\System\DFLJesm.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\XYifwgJ.exe
  C:\Windows\System\XYifwgJ.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\WJCVSGM.exe
  C:\Windows\System\WJCVSGM.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\UqhyowB.exe
  C:\Windows\System\UqhyowB.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\PHcoqbH.exe
  C:\Windows\System\PHcoqbH.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\zqwVrLf.exe
  C:\Windows\System\zqwVrLf.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\OaNEYTc.exe
  C:\Windows\System\OaNEYTc.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\dnelsUv.exe
  C:\Windows\System\dnelsUv.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\rkKCTbF.exe
  C:\Windows\System\rkKCTbF.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\aulFLBa.exe
  C:\Windows\System\aulFLBa.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\WsGjXzl.exe
  C:\Windows\System\WsGjXzl.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\tOjbOmu.exe
  C:\Windows\System\tOjbOmu.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\dlDpbKk.exe
  C:\Windows\System\dlDpbKk.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\JhbyObU.exe
  C:\Windows\System\JhbyObU.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\XvjeVDn.exe
  C:\Windows\System\XvjeVDn.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\NNmdkHT.exe
  C:\Windows\System\NNmdkHT.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\uHJrOEe.exe
  C:\Windows\System\uHJrOEe.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\tMZcNWq.exe
  C:\Windows\System\tMZcNWq.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\ImuvVES.exe
  C:\Windows\System\ImuvVES.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\OCtsFCi.exe
  C:\Windows\System\OCtsFCi.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\uzIwzeI.exe
  C:\Windows\System\uzIwzeI.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\mrSZyuL.exe
  C:\Windows\System\mrSZyuL.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\MrfYISo.exe
  C:\Windows\System\MrfYISo.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\bYEmhWJ.exe
  C:\Windows\System\bYEmhWJ.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\GBTtXCz.exe
  C:\Windows\System\GBTtXCz.exe
  2⤵
  PID:2980
- C:\Windows\System\fRzlYmN.exe
  C:\Windows\System\fRzlYmN.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\AgkLefe.exe
  C:\Windows\System\AgkLefe.exe
  2⤵
  PID:3136
- C:\Windows\System\UICkCHS.exe
  C:\Windows\System\UICkCHS.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\KYGaLjy.exe
  C:\Windows\System\KYGaLjy.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\fbsWiYI.exe
  C:\Windows\System\fbsWiYI.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\QOvPwcX.exe
  C:\Windows\System\QOvPwcX.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\ntJroYs.exe
  C:\Windows\System\ntJroYs.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\rvffSLt.exe
  C:\Windows\System\rvffSLt.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\SqXuZLg.exe
  C:\Windows\System\SqXuZLg.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\kpDhTTl.exe
  C:\Windows\System\kpDhTTl.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\wktqRCV.exe
  C:\Windows\System\wktqRCV.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\HthTGGm.exe
  C:\Windows\System\HthTGGm.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\nDrfBTH.exe
  C:\Windows\System\nDrfBTH.exe
  2⤵
  PID:1568
- C:\Windows\System\iWFXPdP.exe
  C:\Windows\System\iWFXPdP.exe
  2⤵
  PID:3976
- C:\Windows\System\fXeLmoH.exe
  C:\Windows\System\fXeLmoH.exe
  2⤵
  PID:400
- C:\Windows\System\cbRbpjh.exe
  C:\Windows\System\cbRbpjh.exe
  2⤵
  PID:2064
- C:\Windows\System\HaqYXZr.exe
  C:\Windows\System\HaqYXZr.exe
  2⤵
  PID:2520
- C:\Windows\System\METnMAO.exe
  C:\Windows\System\METnMAO.exe
  2⤵
  PID:1408
- C:\Windows\System\PUeXGOk.exe
  C:\Windows\System\PUeXGOk.exe
  2⤵
  PID:4468
- C:\Windows\System\ThhjmkP.exe
  C:\Windows\System\ThhjmkP.exe
  2⤵
  PID:4872
- C:\Windows\System\RKcUWQT.exe
  C:\Windows\System\RKcUWQT.exe
  2⤵
  PID:4576
- C:\Windows\System\SdteENx.exe
  C:\Windows\System\SdteENx.exe
  2⤵
  PID:4364
- C:\Windows\System\PAewgWN.exe
  C:\Windows\System\PAewgWN.exe
  2⤵
  PID:4148
- C:\Windows\System\AhTleUG.exe
  C:\Windows\System\AhTleUG.exe
  2⤵
  PID:3640
- C:\Windows\System\AdNPgpD.exe
  C:\Windows\System\AdNPgpD.exe
  2⤵
  PID:2152
- C:\Windows\System\fjoDxrr.exe
  C:\Windows\System\fjoDxrr.exe
  2⤵
  PID:4476
- C:\Windows\System\aGjDCqT.exe
  C:\Windows\System\aGjDCqT.exe
  2⤵
  PID:2376
- C:\Windows\System\jrWlVVn.exe
  C:\Windows\System\jrWlVVn.exe
  2⤵
  PID:4652
- C:\Windows\System\qAOebvA.exe
  C:\Windows\System\qAOebvA.exe
  2⤵
  PID:2192
- C:\Windows\System\TmqxVcY.exe
  C:\Windows\System\TmqxVcY.exe
  2⤵
  PID:1948
- C:\Windows\System\VwpojTw.exe
  C:\Windows\System\VwpojTw.exe
  2⤵
  PID:872
- C:\Windows\System\mzwNqQA.exe
  C:\Windows\System\mzwNqQA.exe
  2⤵
  PID:1444
- C:\Windows\System\siKKRTv.exe
  C:\Windows\System\siKKRTv.exe
  2⤵
  PID:5124
- C:\Windows\System\LyCyZKL.exe
  C:\Windows\System\LyCyZKL.exe
  2⤵
  PID:5140
- C:\Windows\System\YcUgZNK.exe
  C:\Windows\System\YcUgZNK.exe
  2⤵
  PID:5160
- C:\Windows\System\gLqKpZL.exe
  C:\Windows\System\gLqKpZL.exe
  2⤵
  PID:5180
- C:\Windows\System\FwxtXRV.exe
  C:\Windows\System\FwxtXRV.exe
  2⤵
  PID:5196
- C:\Windows\System\obUTWxI.exe
  C:\Windows\System\obUTWxI.exe
  2⤵
  PID:5220
- C:\Windows\System\eyFtDaK.exe
  C:\Windows\System\eyFtDaK.exe
  2⤵
  PID:5236
- C:\Windows\System\VxXbcTb.exe
  C:\Windows\System\VxXbcTb.exe
  2⤵
  PID:5260
- C:\Windows\System\hlMNQRq.exe
  C:\Windows\System\hlMNQRq.exe
  2⤵
  PID:5276
- C:\Windows\System\bOghJaR.exe
  C:\Windows\System\bOghJaR.exe
  2⤵
  PID:5300
- C:\Windows\System\jjEWHhN.exe
  C:\Windows\System\jjEWHhN.exe
  2⤵
  PID:5316
- C:\Windows\System\RgRyTIG.exe
  C:\Windows\System\RgRyTIG.exe
  2⤵
  PID:5344
- C:\Windows\System\Qnwbgyp.exe
  C:\Windows\System\Qnwbgyp.exe
  2⤵
  PID:5368
- C:\Windows\System\ZLproIY.exe
  C:\Windows\System\ZLproIY.exe
  2⤵
  PID:5388
- C:\Windows\System\RwQxbmj.exe
  C:\Windows\System\RwQxbmj.exe
  2⤵
  PID:5404
- C:\Windows\System\osgIRkQ.exe
  C:\Windows\System\osgIRkQ.exe
  2⤵
  PID:5428
- C:\Windows\System\vjdCQrS.exe
  C:\Windows\System\vjdCQrS.exe
  2⤵
  PID:5444
- C:\Windows\System\zjxLzZK.exe
  C:\Windows\System\zjxLzZK.exe
  2⤵
  PID:5468
- C:\Windows\System\igxMQoM.exe
  C:\Windows\System\igxMQoM.exe
  2⤵
  PID:5488
- C:\Windows\System\poOrFmL.exe
  C:\Windows\System\poOrFmL.exe
  2⤵
  PID:5508
- C:\Windows\System\FFzxDrC.exe
  C:\Windows\System\FFzxDrC.exe
  2⤵
  PID:5524
- C:\Windows\System\DAFpkEs.exe
  C:\Windows\System\DAFpkEs.exe
  2⤵
  PID:5548
- C:\Windows\System\McVdiTx.exe
  C:\Windows\System\McVdiTx.exe
  2⤵
  PID:5568
- C:\Windows\System\zAtFGqh.exe
  C:\Windows\System\zAtFGqh.exe
  2⤵
  PID:5588
- C:\Windows\System\BxmBrUk.exe
  C:\Windows\System\BxmBrUk.exe
  2⤵
  PID:5608
- C:\Windows\System\mGRWDAO.exe
  C:\Windows\System\mGRWDAO.exe
  2⤵
  PID:5628
- C:\Windows\System\mlKFbZh.exe
  C:\Windows\System\mlKFbZh.exe
  2⤵
  PID:5648
- C:\Windows\System\nrEheTN.exe
  C:\Windows\System\nrEheTN.exe
  2⤵
  PID:5664
- C:\Windows\System\PNLqugw.exe
  C:\Windows\System\PNLqugw.exe
  2⤵
  PID:5680
- C:\Windows\System\FsmwJQx.exe
  C:\Windows\System\FsmwJQx.exe
  2⤵
  PID:5700
- C:\Windows\System\WPdPgqR.exe
  C:\Windows\System\WPdPgqR.exe
  2⤵
  PID:5800
- C:\Windows\System\rwGwoKd.exe
  C:\Windows\System\rwGwoKd.exe
  2⤵
  PID:5824
- C:\Windows\System\xxFNZXx.exe
  C:\Windows\System\xxFNZXx.exe
  2⤵
  PID:5844
- C:\Windows\System\UiKJkIB.exe
  C:\Windows\System\UiKJkIB.exe
  2⤵
  PID:5872
- C:\Windows\System\TxtogVc.exe
  C:\Windows\System\TxtogVc.exe
  2⤵
  PID:5896
- C:\Windows\System\PrYjnvo.exe
  C:\Windows\System\PrYjnvo.exe
  2⤵
  PID:5912
- C:\Windows\System\vrFLxkY.exe
  C:\Windows\System\vrFLxkY.exe
  2⤵
  PID:5936
- C:\Windows\System\iqXlzNk.exe
  C:\Windows\System\iqXlzNk.exe
  2⤵
  PID:5952
- C:\Windows\System\kLaREAQ.exe
  C:\Windows\System\kLaREAQ.exe
  2⤵
  PID:5972
- C:\Windows\System\ujlIaAZ.exe
  C:\Windows\System\ujlIaAZ.exe
  2⤵
  PID:5992
- C:\Windows\System\XVEkpMW.exe
  C:\Windows\System\XVEkpMW.exe
  2⤵
  PID:6008
- C:\Windows\System\AQPRGuB.exe
  C:\Windows\System\AQPRGuB.exe
  2⤵
  PID:6032
- C:\Windows\System\ePQGvqm.exe
  C:\Windows\System\ePQGvqm.exe
  2⤵
  PID:6048
- C:\Windows\System\xpbfdJu.exe
  C:\Windows\System\xpbfdJu.exe
  2⤵
  PID:3824
- C:\Windows\System\rYLPboO.exe
  C:\Windows\System\rYLPboO.exe
  2⤵
  PID:4288
- C:\Windows\System\buFYPio.exe
  C:\Windows\System\buFYPio.exe
  2⤵
  PID:3872
- C:\Windows\System\VSvGAFG.exe
  C:\Windows\System\VSvGAFG.exe
  2⤵
  PID:4232
- C:\Windows\System\nuXSvzV.exe
  C:\Windows\System\nuXSvzV.exe
  2⤵
  PID:5440
- C:\Windows\System\NcUBlRZ.exe
  C:\Windows\System\NcUBlRZ.exe
  2⤵
  PID:5532
- C:\Windows\System\FmLVRzp.exe
  C:\Windows\System\FmLVRzp.exe
  2⤵
  PID:5600
- C:\Windows\System\qjZvBSn.exe
  C:\Windows\System\qjZvBSn.exe
  2⤵
  PID:4412
- C:\Windows\System\SaiVSzy.exe
  C:\Windows\System\SaiVSzy.exe
  2⤵
  PID:3492
- C:\Windows\System\yIyOino.exe
  C:\Windows\System\yIyOino.exe
  2⤵
  PID:2780
- C:\Windows\System\PWYoRId.exe
  C:\Windows\System\PWYoRId.exe
  2⤵
  PID:5820
- C:\Windows\System\mDhernh.exe
  C:\Windows\System\mDhernh.exe
  2⤵
  PID:5412
- C:\Windows\System\vbwrcfc.exe
  C:\Windows\System\vbwrcfc.exe
  2⤵
  PID:5452
- C:\Windows\System\kpBWWLK.exe
  C:\Windows\System\kpBWWLK.exe
  2⤵
  PID:5480
- C:\Windows\System\zhFzShS.exe
  C:\Windows\System\zhFzShS.exe
  2⤵
  PID:5888
- C:\Windows\System\JvzlnMD.exe
  C:\Windows\System\JvzlnMD.exe
  2⤵
  PID:5920
- C:\Windows\System\PDvcRqJ.exe
  C:\Windows\System\PDvcRqJ.exe
  2⤵
  PID:5944
- C:\Windows\System\cNbOsZP.exe
  C:\Windows\System\cNbOsZP.exe
  2⤵
  PID:6148
- C:\Windows\System\siVmmBr.exe
  C:\Windows\System\siVmmBr.exe
  2⤵
  PID:6172
- C:\Windows\System\qIMEaKU.exe
  C:\Windows\System\qIMEaKU.exe
  2⤵
  PID:6188
- C:\Windows\System\OcOajDq.exe
  C:\Windows\System\OcOajDq.exe
  2⤵
  PID:6204
- C:\Windows\System\bHWtrLt.exe
  C:\Windows\System\bHWtrLt.exe
  2⤵
  PID:6324
- C:\Windows\System\vsZebsA.exe
  C:\Windows\System\vsZebsA.exe
  2⤵
  PID:6340
- C:\Windows\System\kfxXgpj.exe
  C:\Windows\System\kfxXgpj.exe
  2⤵
  PID:6360
- C:\Windows\System\jcMkUch.exe
  C:\Windows\System\jcMkUch.exe
  2⤵
  PID:6384
- C:\Windows\System\jCELpMl.exe
  C:\Windows\System\jCELpMl.exe
  2⤵
  PID:6404
- C:\Windows\System\LXGATPg.exe
  C:\Windows\System\LXGATPg.exe
  2⤵
  PID:6420
- C:\Windows\System\bgsdnek.exe
  C:\Windows\System\bgsdnek.exe
  2⤵
  PID:6444
- C:\Windows\System\dKyciqZ.exe
  C:\Windows\System\dKyciqZ.exe
  2⤵
  PID:6460
- C:\Windows\System\pjtFNpp.exe
  C:\Windows\System\pjtFNpp.exe
  2⤵
  PID:6484
- C:\Windows\System\VqrKqrF.exe
  C:\Windows\System\VqrKqrF.exe
  2⤵
  PID:6512
- C:\Windows\System\NVfMRcC.exe
  C:\Windows\System\NVfMRcC.exe
  2⤵
  PID:6532
- C:\Windows\System\XpfdXHk.exe
  C:\Windows\System\XpfdXHk.exe
  2⤵
  PID:6548
- C:\Windows\System\FfkwjYB.exe
  C:\Windows\System\FfkwjYB.exe
  2⤵
  PID:6572
- C:\Windows\System\WCRiIhe.exe
  C:\Windows\System\WCRiIhe.exe
  2⤵
  PID:6588
- C:\Windows\System\uIEUoJN.exe
  C:\Windows\System\uIEUoJN.exe
  2⤵
  PID:6612
- C:\Windows\System\yWqFzfU.exe
  C:\Windows\System\yWqFzfU.exe
  2⤵
  PID:6636
- C:\Windows\System\FuVLEUy.exe
  C:\Windows\System\FuVLEUy.exe
  2⤵
  PID:6652
- C:\Windows\System\cxxXBVH.exe
  C:\Windows\System\cxxXBVH.exe
  2⤵
  PID:6668
- C:\Windows\System\KQygRuG.exe
  C:\Windows\System\KQygRuG.exe
  2⤵
  PID:6696
- C:\Windows\System\qPWlFcq.exe
  C:\Windows\System\qPWlFcq.exe
  2⤵
  PID:6716
- C:\Windows\System\sFgMKgS.exe
  C:\Windows\System\sFgMKgS.exe
  2⤵
  PID:6740
- C:\Windows\System\WemufZu.exe
  C:\Windows\System\WemufZu.exe
  2⤵
  PID:6756
- C:\Windows\System\ybwBaun.exe
  C:\Windows\System\ybwBaun.exe
  2⤵
  PID:6780
- C:\Windows\System\jHsSaHq.exe
  C:\Windows\System\jHsSaHq.exe
  2⤵
  PID:6800
- C:\Windows\System\cUuBQak.exe
  C:\Windows\System\cUuBQak.exe
  2⤵
  PID:6820
- C:\Windows\System\ojAiDiF.exe
  C:\Windows\System\ojAiDiF.exe
  2⤵
  PID:6844
- C:\Windows\System\olZEQoK.exe
  C:\Windows\System\olZEQoK.exe
  2⤵
  PID:6860
- C:\Windows\System\gWiKjSV.exe
  C:\Windows\System\gWiKjSV.exe
  2⤵
  PID:6884
- C:\Windows\System\lCwwdSY.exe
  C:\Windows\System\lCwwdSY.exe
  2⤵
  PID:6908
- C:\Windows\System\gDVOvOY.exe
  C:\Windows\System\gDVOvOY.exe
  2⤵
  PID:6928
- C:\Windows\System\JljsuME.exe
  C:\Windows\System\JljsuME.exe
  2⤵
  PID:6944
- C:\Windows\System\aMUiJIY.exe
  C:\Windows\System\aMUiJIY.exe
  2⤵
  PID:6968
- C:\Windows\System\pkHoBxR.exe
  C:\Windows\System\pkHoBxR.exe
  2⤵
  PID:6984
- C:\Windows\System\kbeUTXk.exe
  C:\Windows\System\kbeUTXk.exe
  2⤵
  PID:7008
- C:\Windows\System\YFIWJjP.exe
  C:\Windows\System\YFIWJjP.exe
  2⤵
  PID:7024
- C:\Windows\System\kxMVBuJ.exe
  C:\Windows\System\kxMVBuJ.exe
  2⤵
  PID:7052
- C:\Windows\System\SLiqfus.exe
  C:\Windows\System\SLiqfus.exe
  2⤵
  PID:7068
- C:\Windows\System\GzWxSdv.exe
  C:\Windows\System\GzWxSdv.exe
  2⤵
  PID:7092
- C:\Windows\System\mJBPhVD.exe
  C:\Windows\System\mJBPhVD.exe
  2⤵
  PID:7108
- C:\Windows\System\PiBPiFu.exe
  C:\Windows\System\PiBPiFu.exe
  2⤵
  PID:7132
- C:\Windows\System\CrhKaQV.exe
  C:\Windows\System\CrhKaQV.exe
  2⤵
  PID:7148
- C:\Windows\System\cegKeap.exe
  C:\Windows\System\cegKeap.exe
  2⤵
  PID:1124
- C:\Windows\System\foCaRBc.exe
  C:\Windows\System\foCaRBc.exe
  2⤵
  PID:1016
- C:\Windows\System\PeKopVS.exe
  C:\Windows\System\PeKopVS.exe
  2⤵
  PID:1688
- C:\Windows\System\cAPfXCF.exe
  C:\Windows\System\cAPfXCF.exe
  2⤵
  PID:632
- C:\Windows\System\AbMAwWS.exe
  C:\Windows\System\AbMAwWS.exe
  2⤵
  PID:1968
- C:\Windows\System\IMNfsLE.exe
  C:\Windows\System\IMNfsLE.exe
  2⤵
  PID:4744
- C:\Windows\System\pjIwlmh.exe
  C:\Windows\System\pjIwlmh.exe
  2⤵
  PID:4380
- C:\Windows\System\YExkcks.exe
  C:\Windows\System\YExkcks.exe
  2⤵
  PID:5172
- C:\Windows\System\aQIEcDc.exe
  C:\Windows\System\aQIEcDc.exe
  2⤵
  PID:5204
- C:\Windows\System\vkMSFqY.exe
  C:\Windows\System\vkMSFqY.exe
  2⤵
  PID:5244
- C:\Windows\System\hiAIRQs.exe
  C:\Windows\System\hiAIRQs.exe
  2⤵
  PID:5272
- C:\Windows\System\gqWexHE.exe
  C:\Windows\System\gqWexHE.exe
  2⤵
  PID:5308
- C:\Windows\System\LZjdaSV.exe
  C:\Windows\System\LZjdaSV.exe
  2⤵
  PID:5340
- C:\Windows\System\AiFlAmh.exe
  C:\Windows\System\AiFlAmh.exe
  2⤵
  PID:840
- C:\Windows\System\XmYrOmP.exe
  C:\Windows\System\XmYrOmP.exe
  2⤵
  PID:5424
- C:\Windows\System\xvwPDhK.exe
  C:\Windows\System\xvwPDhK.exe
  2⤵
  PID:4180
- C:\Windows\System\LrePlyF.exe
  C:\Windows\System\LrePlyF.exe
  2⤵
  PID:5620
- C:\Windows\System\maCqtLA.exe
  C:\Windows\System\maCqtLA.exe
  2⤵
  PID:5656
- C:\Windows\System\cadHTSz.exe
  C:\Windows\System\cadHTSz.exe
  2⤵
  PID:7172
- C:\Windows\System\KCFmQEh.exe
  C:\Windows\System\KCFmQEh.exe
  2⤵
  PID:7196
- C:\Windows\System\msDdrbm.exe
  C:\Windows\System\msDdrbm.exe
  2⤵
  PID:7272
- C:\Windows\System\vZBtXyv.exe
  C:\Windows\System\vZBtXyv.exe
  2⤵
  PID:7296
- C:\Windows\System\kQwpMWK.exe
  C:\Windows\System\kQwpMWK.exe
  2⤵
  PID:7324
- C:\Windows\System\QXlLKql.exe
  C:\Windows\System\QXlLKql.exe
  2⤵
  PID:7348
- C:\Windows\System\TdBzccM.exe
  C:\Windows\System\TdBzccM.exe
  2⤵
  PID:7376
- C:\Windows\System\mjRscNA.exe
  C:\Windows\System\mjRscNA.exe
  2⤵
  PID:7400
- C:\Windows\System\mMuWuZq.exe
  C:\Windows\System\mMuWuZq.exe
  2⤵
  PID:7420
- C:\Windows\System\VPkiewA.exe
  C:\Windows\System\VPkiewA.exe
  2⤵
  PID:7448
- C:\Windows\System\sZOrNat.exe
  C:\Windows\System\sZOrNat.exe
  2⤵
  PID:7472
- C:\Windows\System\hyXVKBZ.exe
  C:\Windows\System\hyXVKBZ.exe
  2⤵
  PID:7492
- C:\Windows\System\nKUPQdI.exe
  C:\Windows\System\nKUPQdI.exe
  2⤵
  PID:7508
- C:\Windows\System\noFHVmA.exe
  C:\Windows\System\noFHVmA.exe
  2⤵
  PID:7532
- C:\Windows\System\HKvPWmh.exe
  C:\Windows\System\HKvPWmh.exe
  2⤵
  PID:7552
- C:\Windows\System\pEtYXwI.exe
  C:\Windows\System\pEtYXwI.exe
  2⤵
  PID:7576
- C:\Windows\System\wRXUkwh.exe
  C:\Windows\System\wRXUkwh.exe
  2⤵
  PID:7592
- C:\Windows\System\CSVLsXx.exe
  C:\Windows\System\CSVLsXx.exe
  2⤵
  PID:7616
- C:\Windows\System\hmUzFNY.exe
  C:\Windows\System\hmUzFNY.exe
  2⤵
  PID:7632
- C:\Windows\System\jgIVIyz.exe
  C:\Windows\System\jgIVIyz.exe
  2⤵
  PID:7652
- C:\Windows\System\PGzEJHp.exe
  C:\Windows\System\PGzEJHp.exe
  2⤵
  PID:7676
- C:\Windows\System\efQRNVc.exe
  C:\Windows\System\efQRNVc.exe
  2⤵
  PID:7696
- C:\Windows\System\xzfkFeT.exe
  C:\Windows\System\xzfkFeT.exe
  2⤵
  PID:7716
- C:\Windows\System\cVqKHsS.exe
  C:\Windows\System\cVqKHsS.exe
  2⤵
  PID:7736
- C:\Windows\System\zZSIfTc.exe
  C:\Windows\System\zZSIfTc.exe
  2⤵
  PID:7756
- C:\Windows\System\IAGoTPK.exe
  C:\Windows\System\IAGoTPK.exe
  2⤵
  PID:7780
- C:\Windows\System\GdDXqtu.exe
  C:\Windows\System\GdDXqtu.exe
  2⤵
  PID:7800
- C:\Windows\System\ZuFmEqf.exe
  C:\Windows\System\ZuFmEqf.exe
  2⤵
  PID:7816
- C:\Windows\System\okyWyMb.exe
  C:\Windows\System\okyWyMb.exe
  2⤵
  PID:7844
- C:\Windows\System\cJsXqfh.exe
  C:\Windows\System\cJsXqfh.exe
  2⤵
  PID:7864
- C:\Windows\System\GSQOdhL.exe
  C:\Windows\System\GSQOdhL.exe
  2⤵
  PID:7884
- C:\Windows\System\hHMrRqT.exe
  C:\Windows\System\hHMrRqT.exe
  2⤵
  PID:7908
- C:\Windows\System\QBQHSuk.exe
  C:\Windows\System\QBQHSuk.exe
  2⤵
  PID:7924
- C:\Windows\System\nqrHejc.exe
  C:\Windows\System\nqrHejc.exe
  2⤵
  PID:7948
- C:\Windows\System\yYHHoPY.exe
  C:\Windows\System\yYHHoPY.exe
  2⤵
  PID:7968
- C:\Windows\System\cDCZJYz.exe
  C:\Windows\System\cDCZJYz.exe
  2⤵
  PID:7992
- C:\Windows\System\cqSPmTA.exe
  C:\Windows\System\cqSPmTA.exe
  2⤵
  PID:8008
- C:\Windows\System\PMDRimP.exe
  C:\Windows\System\PMDRimP.exe
  2⤵
  PID:8024
- C:\Windows\System\QMizpod.exe
  C:\Windows\System\QMizpod.exe
  2⤵
  PID:8048
- C:\Windows\System\DSGHzcv.exe
  C:\Windows\System\DSGHzcv.exe
  2⤵
  PID:8072
- C:\Windows\System\lcpTGRS.exe
  C:\Windows\System\lcpTGRS.exe
  2⤵
  PID:8088
- C:\Windows\System\OKhhfxm.exe
  C:\Windows\System\OKhhfxm.exe
  2⤵
  PID:8112
- C:\Windows\System\EKgIChL.exe
  C:\Windows\System\EKgIChL.exe
  2⤵
  PID:8132
- C:\Windows\System\DzBydFe.exe
  C:\Windows\System\DzBydFe.exe
  2⤵
  PID:8152
- C:\Windows\System\uOtinGj.exe
  C:\Windows\System\uOtinGj.exe
  2⤵
  PID:8172
- C:\Windows\System\DKYxfJq.exe
  C:\Windows\System\DKYxfJq.exe
  2⤵
  PID:8188
- C:\Windows\System\sDfcxzQ.exe
  C:\Windows\System\sDfcxzQ.exe
  2⤵
  PID:5768
- C:\Windows\System\KuUMjsW.exe
  C:\Windows\System\KuUMjsW.exe
  2⤵
  PID:6520
- C:\Windows\System\EKqmAqM.exe
  C:\Windows\System\EKqmAqM.exe
  2⤵
  PID:6556
- C:\Windows\System\RPlwxie.exe
  C:\Windows\System\RPlwxie.exe
  2⤵
  PID:6632
- C:\Windows\System\OaHeMOp.exe
  C:\Windows\System\OaHeMOp.exe
  2⤵
  PID:6704
- C:\Windows\System\vZljaTJ.exe
  C:\Windows\System\vZljaTJ.exe
  2⤵
  PID:6736
- C:\Windows\System\JGNEjZP.exe
  C:\Windows\System\JGNEjZP.exe
  2⤵
  PID:4580
- C:\Windows\System\WClqmLA.exe
  C:\Windows\System\WClqmLA.exe
  2⤵
  PID:6852
- C:\Windows\System\IeCgJtZ.exe
  C:\Windows\System\IeCgJtZ.exe
  2⤵
  PID:1632
- C:\Windows\System\FOVYYlT.exe
  C:\Windows\System\FOVYYlT.exe
  2⤵
  PID:6980
- C:\Windows\System\FukbbCN.exe
  C:\Windows\System\FukbbCN.exe
  2⤵
  PID:7020
- C:\Windows\System\yTXOlRw.exe
  C:\Windows\System\yTXOlRw.exe
  2⤵
  PID:5908
- C:\Windows\System\kCRYTIP.exe
  C:\Windows\System\kCRYTIP.exe
  2⤵
  PID:3980
- C:\Windows\System\HQOgMPD.exe
  C:\Windows\System\HQOgMPD.exe
  2⤵
  PID:5332
- C:\Windows\System\mIYXhIT.exe
  C:\Windows\System\mIYXhIT.exe
  2⤵
  PID:6168
- C:\Windows\System\JOGWVCE.exe
  C:\Windows\System\JOGWVCE.exe
  2⤵
  PID:6084
- C:\Windows\System\LodATkq.exe
  C:\Windows\System\LodATkq.exe
  2⤵
  PID:6140
- C:\Windows\System\ZzkeKdG.exe
  C:\Windows\System\ZzkeKdG.exe
  2⤵
  PID:7416
- C:\Windows\System\pIIeLDf.exe
  C:\Windows\System\pIIeLDf.exe
  2⤵
  PID:7440
- C:\Windows\System\QWoHSZK.exe
  C:\Windows\System\QWoHSZK.exe
  2⤵
  PID:6920
- C:\Windows\System\XzkzZcS.exe
  C:\Windows\System\XzkzZcS.exe
  2⤵
  PID:8212
- C:\Windows\System\wcujlgk.exe
  C:\Windows\System\wcujlgk.exe
  2⤵
  PID:8232
- C:\Windows\System\wAisZYH.exe
  C:\Windows\System\wAisZYH.exe
  2⤵
  PID:8256
- C:\Windows\System\jMfcYMh.exe
  C:\Windows\System\jMfcYMh.exe
  2⤵
  PID:8272
- C:\Windows\System\kNeZmyr.exe
  C:\Windows\System\kNeZmyr.exe
  2⤵
  PID:8296
- C:\Windows\System\XhFprom.exe
  C:\Windows\System\XhFprom.exe
  2⤵
  PID:8320
- C:\Windows\System\Fwuseby.exe
  C:\Windows\System\Fwuseby.exe
  2⤵
  PID:8340
- C:\Windows\System\eYNJtGy.exe
  C:\Windows\System\eYNJtGy.exe
  2⤵
  PID:8368
- C:\Windows\System\EhSBeDr.exe
  C:\Windows\System\EhSBeDr.exe
  2⤵
  PID:8388
- C:\Windows\System\WTvLLFp.exe
  C:\Windows\System\WTvLLFp.exe
  2⤵
  PID:8404
- C:\Windows\System\niRJWAU.exe
  C:\Windows\System\niRJWAU.exe
  2⤵
  PID:8420
- C:\Windows\System\HJcYWht.exe
  C:\Windows\System\HJcYWht.exe
  2⤵
  PID:8444
- C:\Windows\System\ZhUtkin.exe
  C:\Windows\System\ZhUtkin.exe
  2⤵
  PID:8460
- C:\Windows\System\CdOcCLL.exe
  C:\Windows\System\CdOcCLL.exe
  2⤵
  PID:8484
- C:\Windows\System\ycnognN.exe
  C:\Windows\System\ycnognN.exe
  2⤵
  PID:8500
- C:\Windows\System\jqgezLs.exe
  C:\Windows\System\jqgezLs.exe
  2⤵
  PID:8524
- C:\Windows\System\uIyexBM.exe
  C:\Windows\System\uIyexBM.exe
  2⤵
  PID:8548
- C:\Windows\System\IcGaRZL.exe
  C:\Windows\System\IcGaRZL.exe
  2⤵
  PID:8572
- C:\Windows\System\OLXVfOX.exe
  C:\Windows\System\OLXVfOX.exe
  2⤵
  PID:8600
- C:\Windows\System\AlZqRuS.exe
  C:\Windows\System\AlZqRuS.exe
  2⤵
  PID:8620
- C:\Windows\System\udVafdC.exe
  C:\Windows\System\udVafdC.exe
  2⤵
  PID:8640
- C:\Windows\System\bVxPlVv.exe
  C:\Windows\System\bVxPlVv.exe
  2⤵
  PID:8660
- C:\Windows\System\ZrosAMI.exe
  C:\Windows\System\ZrosAMI.exe
  2⤵
  PID:8676
- C:\Windows\System\cPVQWIp.exe
  C:\Windows\System\cPVQWIp.exe
  2⤵
  PID:8700
- C:\Windows\System\FvuxFMi.exe
  C:\Windows\System\FvuxFMi.exe
  2⤵
  PID:8716
- C:\Windows\System\vQCjUPr.exe
  C:\Windows\System\vQCjUPr.exe
  2⤵
  PID:8744
- C:\Windows\System\kKbNucm.exe
  C:\Windows\System\kKbNucm.exe
  2⤵
  PID:8764
- C:\Windows\System\HXKIEkT.exe
  C:\Windows\System\HXKIEkT.exe
  2⤵
  PID:8784
- C:\Windows\System\wimXJSg.exe
  C:\Windows\System\wimXJSg.exe
  2⤵
  PID:8804
- C:\Windows\System\zPuwLwW.exe
  C:\Windows\System\zPuwLwW.exe
  2⤵
  PID:8828
- C:\Windows\System\xwItvwe.exe
  C:\Windows\System\xwItvwe.exe
  2⤵
  PID:8848
- C:\Windows\System\BHGyVty.exe
  C:\Windows\System\BHGyVty.exe
  2⤵
  PID:8864
- C:\Windows\System\uWvWuAd.exe
  C:\Windows\System\uWvWuAd.exe
  2⤵
  PID:8888
- C:\Windows\System\rUeUndo.exe
  C:\Windows\System\rUeUndo.exe
  2⤵
  PID:8908
- C:\Windows\System\jqjjXtS.exe
  C:\Windows\System\jqjjXtS.exe
  2⤵
  PID:8928
- C:\Windows\System\zivZGyW.exe
  C:\Windows\System\zivZGyW.exe
  2⤵
  PID:8948
- C:\Windows\System\RVEzNSC.exe
  C:\Windows\System\RVEzNSC.exe
  2⤵
  PID:8968
- C:\Windows\System\wQjitBs.exe
  C:\Windows\System\wQjitBs.exe
  2⤵
  PID:8988
- C:\Windows\System\zlEOVqi.exe
  C:\Windows\System\zlEOVqi.exe
  2⤵
  PID:9004
- C:\Windows\System\qVIYhuo.exe
  C:\Windows\System\qVIYhuo.exe
  2⤵
  PID:9028
- C:\Windows\System\wnZZptI.exe
  C:\Windows\System\wnZZptI.exe
  2⤵
  PID:9052
- C:\Windows\System\dImafeL.exe
  C:\Windows\System\dImafeL.exe
  2⤵
  PID:9068
- C:\Windows\System\vjQHjKq.exe
  C:\Windows\System\vjQHjKq.exe
  2⤵
  PID:9092
- C:\Windows\System\eirMgIP.exe
  C:\Windows\System\eirMgIP.exe
  2⤵
  PID:9112
- C:\Windows\System\EEDWmyG.exe
  C:\Windows\System\EEDWmyG.exe
  2⤵
  PID:9136
- C:\Windows\System\TCMweLu.exe
  C:\Windows\System\TCMweLu.exe
  2⤵
  PID:9152
- C:\Windows\System\SVfYZBe.exe
  C:\Windows\System\SVfYZBe.exe
  2⤵
  PID:9176
- C:\Windows\System\yeEZCHu.exe
  C:\Windows\System\yeEZCHu.exe
  2⤵
  PID:9200
- C:\Windows\System\ijUTxSd.exe
  C:\Windows\System\ijUTxSd.exe
  2⤵
  PID:7544
- C:\Windows\System\KXNdjMt.exe
  C:\Windows\System\KXNdjMt.exe
  2⤵
  PID:6964
- C:\Windows\System\GGofxEy.exe
  C:\Windows\System\GGofxEy.exe
  2⤵
  PID:7608
- C:\Windows\System\uJMPNxi.exe
  C:\Windows\System\uJMPNxi.exe
  2⤵
  PID:7644
- C:\Windows\System\dgFMkZd.exe
  C:\Windows\System\dgFMkZd.exe
  2⤵
  PID:7684
- C:\Windows\System\mSqkUMi.exe
  C:\Windows\System\mSqkUMi.exe
  2⤵
  PID:7768
- C:\Windows\System\smoriJe.exe
  C:\Windows\System\smoriJe.exe
  2⤵
  PID:7100
- C:\Windows\System\PUhvbEW.exe
  C:\Windows\System\PUhvbEW.exe
  2⤵
  PID:7824
- C:\Windows\System\QAWSENH.exe
  C:\Windows\System\QAWSENH.exe
  2⤵
  PID:5564
- C:\Windows\System\GStHNWI.exe
  C:\Windows\System\GStHNWI.exe
  2⤵
  PID:7920
- C:\Windows\System\XXLoDOw.exe
  C:\Windows\System\XXLoDOw.exe
  2⤵
  PID:7960
- C:\Windows\System\fjMIreH.exe
  C:\Windows\System\fjMIreH.exe
  2⤵
  PID:8004
- C:\Windows\System\XChJejv.exe
  C:\Windows\System\XChJejv.exe
  2⤵
  PID:8084
- C:\Windows\System\qSKsALJ.exe
  C:\Windows\System\qSKsALJ.exe
  2⤵
  PID:5476
- C:\Windows\System\CLtflqb.exe
  C:\Windows\System\CLtflqb.exe
  2⤵
  PID:5580
- C:\Windows\System\KWlIeUm.exe
  C:\Windows\System\KWlIeUm.exe
  2⤵
  PID:5752
- C:\Windows\System\OIgIKoA.exe
  C:\Windows\System\OIgIKoA.exe
  2⤵
  PID:6940
- C:\Windows\System\FLVWyUh.exe
  C:\Windows\System\FLVWyUh.exe
  2⤵
  PID:5544
- C:\Windows\System\PvqwCWN.exe
  C:\Windows\System\PvqwCWN.exe
  2⤵
  PID:2308
- C:\Windows\System\MWkDPzb.exe
  C:\Windows\System\MWkDPzb.exe
  2⤵
  PID:9236
- C:\Windows\System\EuZnbdS.exe
  C:\Windows\System\EuZnbdS.exe
  2⤵
  PID:9256
- C:\Windows\System\BMHsvDO.exe
  C:\Windows\System\BMHsvDO.exe
  2⤵
  PID:9272
- C:\Windows\System\dgjfTjF.exe
  C:\Windows\System\dgjfTjF.exe
  2⤵
  PID:9292
- C:\Windows\System\AlDJmqb.exe
  C:\Windows\System\AlDJmqb.exe
  2⤵
  PID:9308
- C:\Windows\System\JrxSbVH.exe
  C:\Windows\System\JrxSbVH.exe
  2⤵
  PID:9332
- C:\Windows\System\YklgSfA.exe
  C:\Windows\System\YklgSfA.exe
  2⤵
  PID:9356
- C:\Windows\System\OZtFJaa.exe
  C:\Windows\System\OZtFJaa.exe
  2⤵
  PID:9372
- C:\Windows\System\NBiMnpL.exe
  C:\Windows\System\NBiMnpL.exe
  2⤵
  PID:9396
- C:\Windows\System\TsvnzAU.exe
  C:\Windows\System\TsvnzAU.exe
  2⤵
  PID:9436
- C:\Windows\System\WkaOIGU.exe
  C:\Windows\System\WkaOIGU.exe
  2⤵
  PID:9476
- C:\Windows\System\hkdFivw.exe
  C:\Windows\System\hkdFivw.exe
  2⤵
  PID:9500
- C:\Windows\System\AZDOddx.exe
  C:\Windows\System\AZDOddx.exe
  2⤵
  PID:9516
- C:\Windows\System\dHftClJ.exe
  C:\Windows\System\dHftClJ.exe
  2⤵
  PID:9540
- C:\Windows\System\ZrVQcBH.exe
  C:\Windows\System\ZrVQcBH.exe
  2⤵
  PID:9564
- C:\Windows\System\beKCBVO.exe
  C:\Windows\System\beKCBVO.exe
  2⤵
  PID:9584
- C:\Windows\System\ZlGOGiS.exe
  C:\Windows\System\ZlGOGiS.exe
  2⤵
  PID:9604
- C:\Windows\System\EClpwhk.exe
  C:\Windows\System\EClpwhk.exe
  2⤵
  PID:9628
- C:\Windows\System\pFrLbeU.exe
  C:\Windows\System\pFrLbeU.exe
  2⤵
  PID:9648
- C:\Windows\System\ewXtyWA.exe
  C:\Windows\System\ewXtyWA.exe
  2⤵
  PID:9668
- C:\Windows\System\gCOJsyL.exe
  C:\Windows\System\gCOJsyL.exe
  2⤵
  PID:9684
- C:\Windows\System\SdNntAE.exe
  C:\Windows\System\SdNntAE.exe
  2⤵
  PID:9704
- C:\Windows\System\GWdNzey.exe
  C:\Windows\System\GWdNzey.exe
  2⤵
  PID:9728
- C:\Windows\System\SaXivcp.exe
  C:\Windows\System\SaXivcp.exe
  2⤵
  PID:9752
- C:\Windows\System\ELXnGoS.exe
  C:\Windows\System\ELXnGoS.exe
  2⤵
  PID:9772
- C:\Windows\System\mZoZggU.exe
  C:\Windows\System\mZoZggU.exe
  2⤵
  PID:9792
- C:\Windows\System\fQvzIyp.exe
  C:\Windows\System\fQvzIyp.exe
  2⤵
  PID:9816
- C:\Windows\System\PuVgKTD.exe
  C:\Windows\System\PuVgKTD.exe
  2⤵
  PID:9836
- C:\Windows\System\fOfOGkM.exe
  C:\Windows\System\fOfOGkM.exe
  2⤵
  PID:9852
- C:\Windows\System\MmzcLdX.exe
  C:\Windows\System\MmzcLdX.exe
  2⤵
  PID:9872
- C:\Windows\System\CFfSLDt.exe
  C:\Windows\System\CFfSLDt.exe
  2⤵
  PID:9892
- C:\Windows\System\wLrdRuM.exe
  C:\Windows\System\wLrdRuM.exe
  2⤵
  PID:9912
- C:\Windows\System\yRFzPKi.exe
  C:\Windows\System\yRFzPKi.exe
  2⤵
  PID:9932
- C:\Windows\System\xpToSOq.exe
  C:\Windows\System\xpToSOq.exe
  2⤵
  PID:9956
- C:\Windows\System\gcvpvKO.exe
  C:\Windows\System\gcvpvKO.exe
  2⤵
  PID:9976
- C:\Windows\System\EvLJCZI.exe
  C:\Windows\System\EvLJCZI.exe
  2⤵
  PID:9996
- C:\Windows\System\CEVoRZJ.exe
  C:\Windows\System\CEVoRZJ.exe
  2⤵
  PID:10024
- C:\Windows\System\mZalQIe.exe
  C:\Windows\System\mZalQIe.exe
  2⤵
  PID:10040
- C:\Windows\System\PtQebsA.exe
  C:\Windows\System\PtQebsA.exe
  2⤵
  PID:10060
- C:\Windows\System\rSevAii.exe
  C:\Windows\System\rSevAii.exe
  2⤵
  PID:10080
- C:\Windows\System\QVtpRcC.exe
  C:\Windows\System\QVtpRcC.exe
  2⤵
  PID:10104
- C:\Windows\System\wtUxZzL.exe
  C:\Windows\System\wtUxZzL.exe
  2⤵
  PID:10132
- C:\Windows\System\uvYUxuD.exe
  C:\Windows\System\uvYUxuD.exe
  2⤵
  PID:10152
- C:\Windows\System\xUZbzef.exe
  C:\Windows\System\xUZbzef.exe
  2⤵
  PID:10168
- C:\Windows\System\AtgTYay.exe
  C:\Windows\System\AtgTYay.exe
  2⤵
  PID:10192
- C:\Windows\System\oFprxZe.exe
  C:\Windows\System\oFprxZe.exe
  2⤵
  PID:10212
- C:\Windows\System\NUavVzJ.exe
  C:\Windows\System\NUavVzJ.exe
  2⤵
  PID:10236
- C:\Windows\System\qXPlLvC.exe
  C:\Windows\System\qXPlLvC.exe
  2⤵
  PID:6332
- C:\Windows\System\UxrqUTg.exe
  C:\Windows\System\UxrqUTg.exe
  2⤵
  PID:6356
- C:\Windows\System\WhtUGGZ.exe
  C:\Windows\System\WhtUGGZ.exe
  2⤵
  PID:6400
- C:\Windows\System\tbmjQvW.exe
  C:\Windows\System\tbmjQvW.exe
  2⤵
  PID:6440
- C:\Windows\System\bhukrHd.exe
  C:\Windows\System\bhukrHd.exe
  2⤵
  PID:6492
- C:\Windows\System\xYQAYxA.exe
  C:\Windows\System\xYQAYxA.exe
  2⤵
  PID:6596
- C:\Windows\System\iQPrufb.exe
  C:\Windows\System\iQPrufb.exe
  2⤵
  PID:6004
- C:\Windows\System\pUIUdqp.exe
  C:\Windows\System\pUIUdqp.exe
  2⤵
  PID:6124
- C:\Windows\System\GXoMSIG.exe
  C:\Windows\System\GXoMSIG.exe
  2⤵
  PID:6892
- C:\Windows\System\TaIVFqi.exe
  C:\Windows\System\TaIVFqi.exe
  2⤵
  PID:8252
- C:\Windows\System\reqfLRH.exe
  C:\Windows\System\reqfLRH.exe
  2⤵
  PID:7064
- C:\Windows\System\mGCZxYW.exe
  C:\Windows\System\mGCZxYW.exe
  2⤵
  PID:8432
- C:\Windows\System\XZaEKSF.exe
  C:\Windows\System\XZaEKSF.exe
  2⤵
  PID:7880
- C:\Windows\System\sqGTMFB.exe
  C:\Windows\System\sqGTMFB.exe
  2⤵
  PID:8584
- C:\Windows\System\XrYrgdS.exe
  C:\Windows\System\XrYrgdS.exe
  2⤵
  PID:1224
- C:\Windows\System\qWRdNya.exe
  C:\Windows\System\qWRdNya.exe
  2⤵
  PID:8776
- C:\Windows\System\XnxQbTg.exe
  C:\Windows\System\XnxQbTg.exe
  2⤵
  PID:8820
- C:\Windows\System\UWYpCxJ.exe
  C:\Windows\System\UWYpCxJ.exe
  2⤵
  PID:8080
- C:\Windows\System\YCgWypv.exe
  C:\Windows\System\YCgWypv.exe
  2⤵
  PID:10244
- C:\Windows\System\RxNNLCb.exe
  C:\Windows\System\RxNNLCb.exe
  2⤵
  PID:10264
- C:\Windows\System\IDErLdn.exe
  C:\Windows\System\IDErLdn.exe
  2⤵
  PID:10284
- C:\Windows\System\mhiSlbA.exe
  C:\Windows\System\mhiSlbA.exe
  2⤵
  PID:10328
- C:\Windows\System\UqTmJqT.exe
  C:\Windows\System\UqTmJqT.exe
  2⤵
  PID:6196
- C:\Windows\System\yFUbXmn.exe
  C:\Windows\System\yFUbXmn.exe
  2⤵
  PID:5688
- C:\Windows\System\iFdIMHw.exe
  C:\Windows\System\iFdIMHw.exe
  2⤵
  PID:7188
- C:\Windows\System\GSjDocS.exe
  C:\Windows\System\GSjDocS.exe
  2⤵
  PID:7292
- C:\Windows\System\GHGjJsF.exe
  C:\Windows\System\GHGjJsF.exe
  2⤵
  PID:7360
- C:\Windows\System\UEqaDIx.exe
  C:\Windows\System\UEqaDIx.exe
  2⤵
  PID:7428
- C:\Windows\System\HDUKmQf.exe
  C:\Windows\System\HDUKmQf.exe
  2⤵
  PID:7588
- C:\Windows\System\pPUSIBT.exe
  C:\Windows\System\pPUSIBT.exe
  2⤵
  PID:7748
- C:\Windows\System\PIjSfwv.exe
  C:\Windows\System\PIjSfwv.exe
  2⤵
  PID:7900
- C:\Windows\System\iSVWCXy.exe
  C:\Windows\System\iSVWCXy.exe
  2⤵
  PID:7944
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 7944 -s 28
    3⤵
    PID:12728
- C:\Windows\System\CuIFXLz.exe
  C:\Windows\System\CuIFXLz.exe
  2⤵
  PID:8168
- C:\Windows\System\gSSxfOf.exe
  C:\Windows\System\gSSxfOf.exe
  2⤵
  PID:6788
- C:\Windows\System\lrukynJ.exe
  C:\Windows\System\lrukynJ.exe
  2⤵
  PID:7044
- C:\Windows\System\BYFlVXj.exe
  C:\Windows\System\BYFlVXj.exe
  2⤵
  PID:8204
- C:\Windows\System\nFbmqrP.exe
  C:\Windows\System\nFbmqrP.exe
  2⤵
  PID:8792
- C:\Windows\System\sETHLBQ.exe
  C:\Windows\System\sETHLBQ.exe
  2⤵
  PID:8976
- C:\Windows\System\xqzPkuT.exe
  C:\Windows\System\xqzPkuT.exe
  2⤵
  PID:9120
- C:\Windows\System\psZUbnY.exe
  C:\Windows\System\psZUbnY.exe
  2⤵
  PID:9184
- C:\Windows\System\mXqVsvW.exe
  C:\Windows\System\mXqVsvW.exe
  2⤵
  PID:7604
- C:\Windows\System\TYDxYUb.exe
  C:\Windows\System\TYDxYUb.exe
  2⤵
  PID:7904
- C:\Windows\System\ELYfIQT.exe
  C:\Windows\System\ELYfIQT.exe
  2⤵
  PID:8164
- C:\Windows\System\uXXearW.exe
  C:\Windows\System\uXXearW.exe
  2⤵
  PID:6712
- C:\Windows\System\cETfAlL.exe
  C:\Windows\System\cETfAlL.exe
  2⤵
  PID:852
- C:\Windows\System\SidWxRh.exe
  C:\Windows\System\SidWxRh.exe
  2⤵
  PID:9288
- C:\Windows\System\YbCBdBG.exe
  C:\Windows\System\YbCBdBG.exe
  2⤵
  PID:9368
- C:\Windows\System\hmCaZzU.exe
  C:\Windows\System\hmCaZzU.exe
  2⤵
  PID:9432
- C:\Windows\System\cWlZGME.exe
  C:\Windows\System\cWlZGME.exe
  2⤵
  PID:9484
- C:\Windows\System\SKfVsGD.exe
  C:\Windows\System\SKfVsGD.exe
  2⤵
  PID:9576
- C:\Windows\System\GhHpqbp.exe
  C:\Windows\System\GhHpqbp.exe
  2⤵
  PID:9680
- C:\Windows\System\FyuJxjR.exe
  C:\Windows\System\FyuJxjR.exe
  2⤵
  PID:9740
- C:\Windows\System\lEnaJmK.exe
  C:\Windows\System\lEnaJmK.exe
  2⤵
  PID:9828
- C:\Windows\System\KiXBPVR.exe
  C:\Windows\System\KiXBPVR.exe
  2⤵
  PID:9928
- C:\Windows\System\vpFMcSJ.exe
  C:\Windows\System\vpFMcSJ.exe
  2⤵
  PID:10004
- C:\Windows\System\ZNbnxFA.exe
  C:\Windows\System\ZNbnxFA.exe
  2⤵
  PID:10076
- C:\Windows\System\wPblURL.exe
  C:\Windows\System\wPblURL.exe
  2⤵
  PID:10144
- C:\Windows\System\fMedCjJ.exe
  C:\Windows\System\fMedCjJ.exe
  2⤵
  PID:10208
- C:\Windows\System\giOMeez.exe
  C:\Windows\System\giOMeez.exe
  2⤵
  PID:6352
- C:\Windows\System\njjyvkV.exe
  C:\Windows\System\njjyvkV.exe
  2⤵
  PID:6480
- C:\Windows\System\fPZmoFn.exe
  C:\Windows\System\fPZmoFn.exe
  2⤵
  PID:6100
- C:\Windows\System\xDmiBzM.exe
  C:\Windows\System\xDmiBzM.exe
  2⤵
  PID:8264
- C:\Windows\System\ZdhdqEB.exe
  C:\Windows\System\ZdhdqEB.exe
  2⤵
  PID:7876
- C:\Windows\System\AwJRGEL.exe
  C:\Windows\System\AwJRGEL.exe
  2⤵
  PID:8732
- C:\Windows\System\MuhByhb.exe
  C:\Windows\System\MuhByhb.exe
  2⤵
  PID:8036
- C:\Windows\System\IQgQPNM.exe
  C:\Windows\System\IQgQPNM.exe
  2⤵
  PID:5072
- C:\Windows\System\QazGlxk.exe
  C:\Windows\System\QazGlxk.exe
  2⤵
  PID:7184
- C:\Windows\System\aihRApE.exe
  C:\Windows\System\aihRApE.exe
  2⤵
  PID:1600
- C:\Windows\System\vskNHmM.exe
  C:\Windows\System\vskNHmM.exe
  2⤵
  PID:1320
- C:\Windows\System\kIAyiDV.exe
  C:\Windows\System\kIAyiDV.exe
  2⤵
  PID:2176
- C:\Windows\System\yxGaPvw.exe
  C:\Windows\System\yxGaPvw.exe
  2⤵
  PID:4836
- C:\Windows\System\kRFpuLk.exe
  C:\Windows\System\kRFpuLk.exe
  2⤵
  PID:2316
- C:\Windows\System\jtVrkuS.exe
  C:\Windows\System\jtVrkuS.exe
  2⤵
  PID:1608
- C:\Windows\System\JSQJTWv.exe
  C:\Windows\System\JSQJTWv.exe
  2⤵
  PID:2380
- C:\Windows\System\kLlGPTV.exe
  C:\Windows\System\kLlGPTV.exe
  2⤵
  PID:4556
- C:\Windows\System\XLKFrRz.exe
  C:\Windows\System\XLKFrRz.exe
  2⤵
  PID:3332
- C:\Windows\System\YytWkcP.exe
  C:\Windows\System\YytWkcP.exe
  2⤵
  PID:4176
- C:\Windows\System\TVFFsHo.exe
  C:\Windows\System\TVFFsHo.exe
  2⤵
  PID:5960
- C:\Windows\System\yzqhqJm.exe
  C:\Windows\System\yzqhqJm.exe
  2⤵
  PID:6664
- C:\Windows\System\zpuFuZN.exe
  C:\Windows\System\zpuFuZN.exe
  2⤵
  PID:10336
- C:\Windows\System\iIEyZMR.exe
  C:\Windows\System\iIEyZMR.exe
  2⤵
  PID:7836
- C:\Windows\System\JIHiNeF.exe
  C:\Windows\System\JIHiNeF.exe
  2⤵
  PID:9264
- C:\Windows\System\pVBxPQE.exe
  C:\Windows\System\pVBxPQE.exe
  2⤵
  PID:9384
- C:\Windows\System\IXSljsc.exe
  C:\Windows\System\IXSljsc.exe
  2⤵
  PID:9572
- C:\Windows\System\YijsZAR.exe
  C:\Windows\System\YijsZAR.exe
  2⤵
  PID:780
- C:\Windows\System\BNzfqOv.exe
  C:\Windows\System\BNzfqOv.exe
  2⤵
  PID:9060
- C:\Windows\System\WPoTqyR.exe
  C:\Windows\System\WPoTqyR.exe
  2⤵
  PID:9124
- C:\Windows\System\AtTiuDk.exe
  C:\Windows\System\AtTiuDk.exe
  2⤵
  PID:6936
- C:\Windows\System\VaUxiso.exe
  C:\Windows\System\VaUxiso.exe
  2⤵
  PID:6620
- C:\Windows\System\RoAgezu.exe
  C:\Windows\System\RoAgezu.exe
  2⤵
  PID:9964
- C:\Windows\System\QFTahJZ.exe
  C:\Windows\System\QFTahJZ.exe
  2⤵
  PID:10052
- C:\Windows\System\JKEKayE.exe
  C:\Windows\System\JKEKayE.exe
  2⤵
  PID:6812
- C:\Windows\System\JlsYUsc.exe
  C:\Windows\System\JlsYUsc.exe
  2⤵
  PID:7808
- C:\Windows\System\jRyvKTD.exe
  C:\Windows\System\jRyvKTD.exe
  2⤵
  PID:7976
- C:\Windows\System\GjeBgju.exe
  C:\Windows\System\GjeBgju.exe
  2⤵
  PID:10272
- C:\Windows\System\AoyNtqc.exe
  C:\Windows\System\AoyNtqc.exe
  2⤵
  PID:10644
- C:\Windows\System\TsFTepN.exe
  C:\Windows\System\TsFTepN.exe
  2⤵
  PID:10944
- C:\Windows\System\xGpyQNh.exe
  C:\Windows\System\xGpyQNh.exe
  2⤵
  PID:11156
- C:\Windows\System\bEovrbl.exe
  C:\Windows\System\bEovrbl.exe
  2⤵
  PID:1080
- C:\Windows\System\kcuCbnv.exe
  C:\Windows\System\kcuCbnv.exe
  2⤵
  PID:7244
- C:\Windows\System\Nylbtcy.exe
  C:\Windows\System\Nylbtcy.exe
  2⤵
  PID:11292
- C:\Windows\System\IiGJZzp.exe
  C:\Windows\System\IiGJZzp.exe
  2⤵
  PID:11308
- C:\Windows\System\OcohkNT.exe
  C:\Windows\System\OcohkNT.exe
  2⤵
  PID:11332
- C:\Windows\System\gpWLeKd.exe
  C:\Windows\System\gpWLeKd.exe
  2⤵
  PID:11356
- C:\Windows\System\MOtvMrg.exe
  C:\Windows\System\MOtvMrg.exe
  2⤵
  PID:11380
- C:\Windows\System\UvbuvME.exe
  C:\Windows\System\UvbuvME.exe
  2⤵
  PID:11404
- C:\Windows\System\SVBWbuS.exe
  C:\Windows\System\SVBWbuS.exe
  2⤵
  PID:11428
- C:\Windows\System\fzqDgAw.exe
  C:\Windows\System\fzqDgAw.exe
  2⤵
  PID:11444
- C:\Windows\System\lNefLHq.exe
  C:\Windows\System\lNefLHq.exe
  2⤵
  PID:11468
- C:\Windows\System\EVUsecl.exe
  C:\Windows\System\EVUsecl.exe
  2⤵
  PID:11496
- C:\Windows\System\GaIInQn.exe
  C:\Windows\System\GaIInQn.exe
  2⤵
  PID:11512
- C:\Windows\System\QPdOBZn.exe
  C:\Windows\System\QPdOBZn.exe
  2⤵
  PID:11536
- C:\Windows\System\dOQVHwx.exe
  C:\Windows\System\dOQVHwx.exe
  2⤵
  PID:11560
- C:\Windows\System\BQQsdNa.exe
  C:\Windows\System\BQQsdNa.exe
  2⤵
  PID:11580
- C:\Windows\System\eIhDpyr.exe
  C:\Windows\System\eIhDpyr.exe
  2⤵
  PID:11600
- C:\Windows\System\pBEVXfB.exe
  C:\Windows\System\pBEVXfB.exe
  2⤵
  PID:11624
- C:\Windows\System\PYhWWkP.exe
  C:\Windows\System\PYhWWkP.exe
  2⤵
  PID:11648
- C:\Windows\System\yMmbvXM.exe
  C:\Windows\System\yMmbvXM.exe
  2⤵
  PID:11672
- C:\Windows\System\CHINkJJ.exe
  C:\Windows\System\CHINkJJ.exe
  2⤵
  PID:11692
- C:\Windows\System\TFMIBCL.exe
  C:\Windows\System\TFMIBCL.exe
  2⤵
  PID:11708
- C:\Windows\System\QSHeRca.exe
  C:\Windows\System\QSHeRca.exe
  2⤵
  PID:11732
- C:\Windows\System\NCmrfZa.exe
  C:\Windows\System\NCmrfZa.exe
  2⤵
  PID:11760
- C:\Windows\System\lOptleG.exe
  C:\Windows\System\lOptleG.exe
  2⤵
  PID:11780
- C:\Windows\System\eglaOCp.exe
  C:\Windows\System\eglaOCp.exe
  2⤵
  PID:11796
- C:\Windows\System\xpNacpS.exe
  C:\Windows\System\xpNacpS.exe
  2⤵
  PID:11828
- C:\Windows\System\qRUVvlu.exe
  C:\Windows\System\qRUVvlu.exe
  2⤵
  PID:11844
- C:\Windows\System\kvMyzXJ.exe
  C:\Windows\System\kvMyzXJ.exe
  2⤵
  PID:11860
- C:\Windows\System\cZBRlet.exe
  C:\Windows\System\cZBRlet.exe
  2⤵
  PID:11876
- C:\Windows\System\RDFooTF.exe
  C:\Windows\System\RDFooTF.exe
  2⤵
  PID:11892
- C:\Windows\System\qMdQuuU.exe
  C:\Windows\System\qMdQuuU.exe
  2⤵
  PID:11908
- C:\Windows\System\GaNwTqm.exe
  C:\Windows\System\GaNwTqm.exe
  2⤵
  PID:11928
- C:\Windows\System\lHbtQLC.exe
  C:\Windows\System\lHbtQLC.exe
  2⤵
  PID:11956
- C:\Windows\System\KzoTcmF.exe
  C:\Windows\System\KzoTcmF.exe
  2⤵
  PID:11976
- C:\Windows\System\uoZAPAo.exe
  C:\Windows\System\uoZAPAo.exe
  2⤵
  PID:12000
- C:\Windows\System\UgFYFwz.exe
  C:\Windows\System\UgFYFwz.exe
  2⤵
  PID:12020
- C:\Windows\System\TeyCmOf.exe
  C:\Windows\System\TeyCmOf.exe
  2⤵
  PID:12048
- C:\Windows\System\OxphTTa.exe
  C:\Windows\System\OxphTTa.exe
  2⤵
  PID:12068
- C:\Windows\System\NITTKGN.exe
  C:\Windows\System\NITTKGN.exe
  2⤵
  PID:12088
- C:\Windows\System\gTkVgAM.exe
  C:\Windows\System\gTkVgAM.exe
  2⤵
  PID:12108
- C:\Windows\System\jGAPRmi.exe
  C:\Windows\System\jGAPRmi.exe
  2⤵
  PID:12128
- C:\Windows\System\CMUMJrc.exe
  C:\Windows\System\CMUMJrc.exe
  2⤵
  PID:12148
- C:\Windows\System\hsgxOiR.exe
  C:\Windows\System\hsgxOiR.exe
  2⤵
  PID:12176
- C:\Windows\System\ntcxwsj.exe
  C:\Windows\System\ntcxwsj.exe
  2⤵
  PID:12192
- C:\Windows\System\VbUxiVT.exe
  C:\Windows\System\VbUxiVT.exe
  2⤵
  PID:12216
- C:\Windows\System\LgZyyhS.exe
  C:\Windows\System\LgZyyhS.exe
  2⤵
  PID:12236
- C:\Windows\System\FbqZMDK.exe
  C:\Windows\System\FbqZMDK.exe
  2⤵
  PID:12256
- C:\Windows\System\qdXJGgr.exe
  C:\Windows\System\qdXJGgr.exe
  2⤵
  PID:12280
- C:\Windows\System\JsCEnaX.exe
  C:\Windows\System\JsCEnaX.exe
  2⤵
  PID:8632
- C:\Windows\System\zAwhCZh.exe
  C:\Windows\System\zAwhCZh.exe
  2⤵
  PID:10756
- C:\Windows\System\zBIgZza.exe
  C:\Windows\System\zBIgZza.exe
  2⤵
  PID:10804
- C:\Windows\System\ahRAUWA.exe
  C:\Windows\System\ahRAUWA.exe
  2⤵
  PID:10868
- C:\Windows\System\iNoKDOJ.exe
  C:\Windows\System\iNoKDOJ.exe
  2⤵
  PID:10900
- C:\Windows\System\peZmpdV.exe
  C:\Windows\System\peZmpdV.exe
  2⤵
  PID:7540
- C:\Windows\System\hVXjPJo.exe
  C:\Windows\System\hVXjPJo.exe
  2⤵
  PID:5560
- C:\Windows\System\fbkPQQv.exe
  C:\Windows\System\fbkPQQv.exe
  2⤵
  PID:11016
- C:\Windows\System\nemndLw.exe
  C:\Windows\System\nemndLw.exe
  2⤵
  PID:12300
- C:\Windows\System\vbNmQVh.exe
  C:\Windows\System\vbNmQVh.exe
  2⤵
  PID:12324
- C:\Windows\System\sDBkuym.exe
  C:\Windows\System\sDBkuym.exe
  2⤵
  PID:12348
- C:\Windows\System\UMVLBBG.exe
  C:\Windows\System\UMVLBBG.exe
  2⤵
  PID:12368
- C:\Windows\System\JWJkHvp.exe
  C:\Windows\System\JWJkHvp.exe
  2⤵
  PID:12392
- C:\Windows\System\GAuTIjj.exe
  C:\Windows\System\GAuTIjj.exe
  2⤵
  PID:12408
- C:\Windows\System\BGLWBsQ.exe
  C:\Windows\System\BGLWBsQ.exe
  2⤵
  PID:12432
- C:\Windows\System\dwnjNYJ.exe
  C:\Windows\System\dwnjNYJ.exe
  2⤵
  PID:12452
- C:\Windows\System\AlRlVax.exe
  C:\Windows\System\AlRlVax.exe
  2⤵
  PID:12472
- C:\Windows\System\fLDSSAH.exe
  C:\Windows\System\fLDSSAH.exe
  2⤵
  PID:12500
- C:\Windows\System\NXqgRiU.exe
  C:\Windows\System\NXqgRiU.exe
  2⤵
  PID:12524
- C:\Windows\System\NwQmIfQ.exe
  C:\Windows\System\NwQmIfQ.exe
  2⤵
  PID:12544
- C:\Windows\System\AqgHLKG.exe
  C:\Windows\System\AqgHLKG.exe
  2⤵
  PID:12564
- C:\Windows\System\wbmgdFz.exe
  C:\Windows\System\wbmgdFz.exe
  2⤵
  PID:12584
- C:\Windows\System\vUdqVrX.exe
  C:\Windows\System\vUdqVrX.exe
  2⤵
  PID:12600
- C:\Windows\System\FLXGcFz.exe
  C:\Windows\System\FLXGcFz.exe
  2⤵
  PID:12616
- C:\Windows\System\pNtWSYn.exe
  C:\Windows\System\pNtWSYn.exe
  2⤵
  PID:12636
- C:\Windows\System\rqHkFcB.exe
  C:\Windows\System\rqHkFcB.exe
  2⤵
  PID:12656
- C:\Windows\System\HgtBRBc.exe
  C:\Windows\System\HgtBRBc.exe
  2⤵
  PID:12672
- C:\Windows\System\iftWdQk.exe
  C:\Windows\System\iftWdQk.exe
  2⤵
  PID:12696
- C:\Windows\System\ESGbQRp.exe
  C:\Windows\System\ESGbQRp.exe
  2⤵
  PID:12716
- C:\Windows\System\BINTVZH.exe
  C:\Windows\System\BINTVZH.exe
  2⤵
  PID:12740
- C:\Windows\System\uQEvekh.exe
  C:\Windows\System\uQEvekh.exe
  2⤵
  PID:12756
- C:\Windows\System\zjHFFLc.exe
  C:\Windows\System\zjHFFLc.exe
  2⤵
  PID:12780
- C:\Windows\System\reOfxSv.exe
  C:\Windows\System\reOfxSv.exe
  2⤵
  PID:12800
- C:\Windows\System\ppQwlQj.exe
  C:\Windows\System\ppQwlQj.exe
  2⤵
  PID:12816
- C:\Windows\System\KhWVdiu.exe
  C:\Windows\System\KhWVdiu.exe
  2⤵
  PID:12832
- C:\Windows\System\SaqpLTG.exe
  C:\Windows\System\SaqpLTG.exe
  2⤵
  PID:12848
- C:\Windows\System\mhJqTqN.exe
  C:\Windows\System\mhJqTqN.exe
  2⤵
  PID:12868
- C:\Windows\System\mimxqjx.exe
  C:\Windows\System\mimxqjx.exe
  2⤵
  PID:12888
- C:\Windows\System\VRNcpDU.exe
  C:\Windows\System\VRNcpDU.exe
  2⤵
  PID:12904
- C:\Windows\System\leRlifc.exe
  C:\Windows\System\leRlifc.exe
  2⤵
  PID:12924
- C:\Windows\System\vymtBbJ.exe
  C:\Windows\System\vymtBbJ.exe
  2⤵
  PID:12944
- C:\Windows\System\MTXDxrQ.exe
  C:\Windows\System\MTXDxrQ.exe
  2⤵
  PID:12964
- C:\Windows\System\EPoFIhH.exe
  C:\Windows\System\EPoFIhH.exe
  2⤵
  PID:12980
- C:\Windows\System\wKedslR.exe
  C:\Windows\System\wKedslR.exe
  2⤵
  PID:12996
- C:\Windows\System\fVWkFWy.exe
  C:\Windows\System\fVWkFWy.exe
  2⤵
  PID:13012
- C:\Windows\System\rOJyDQc.exe
  C:\Windows\System\rOJyDQc.exe
  2⤵
  PID:13028
- C:\Windows\System\CJlXpfu.exe
  C:\Windows\System\CJlXpfu.exe
  2⤵
  PID:13044
- C:\Windows\System\MqBWnYv.exe
  C:\Windows\System\MqBWnYv.exe
  2⤵
  PID:13060
- C:\Windows\System\LWkPBBe.exe
  C:\Windows\System\LWkPBBe.exe
  2⤵
  PID:13076
- C:\Windows\System\GplSEsO.exe
  C:\Windows\System\GplSEsO.exe
  2⤵
  PID:13092
- C:\Windows\System\EkMMylr.exe
  C:\Windows\System\EkMMylr.exe
  2⤵
  PID:13108
- C:\Windows\System\BpONHAq.exe
  C:\Windows\System\BpONHAq.exe
  2⤵
  PID:13124
- C:\Windows\System\ajdlEDp.exe
  C:\Windows\System\ajdlEDp.exe
  2⤵
  PID:13144
- C:\Windows\System\PvwRqLQ.exe
  C:\Windows\System\PvwRqLQ.exe
  2⤵
  PID:13168
- C:\Windows\System\DTZbINU.exe
  C:\Windows\System\DTZbINU.exe
  2⤵
  PID:13188
- C:\Windows\System\pWVNwOZ.exe
  C:\Windows\System\pWVNwOZ.exe
  2⤵
  PID:13208
- C:\Windows\System\JTGQvOB.exe
  C:\Windows\System\JTGQvOB.exe
  2⤵
  PID:13232
- C:\Windows\System\bNpfQgc.exe
  C:\Windows\System\bNpfQgc.exe
  2⤵
  PID:13256
- C:\Windows\System\UbdxzwK.exe
  C:\Windows\System\UbdxzwK.exe
  2⤵
  PID:13280
- C:\Windows\System\aFxQSTt.exe
  C:\Windows\System\aFxQSTt.exe
  2⤵
  PID:13300
- C:\Windows\System\GRDejkd.exe
  C:\Windows\System\GRDejkd.exe
  2⤵
  PID:9992
- C:\Windows\System\kkFkUvO.exe
  C:\Windows\System\kkFkUvO.exe
  2⤵
  PID:13176
- C:\Windows\System\UstKMuV.exe
  C:\Windows\System\UstKMuV.exe
  2⤵
  PID:12936
- C:\Windows\System\XBdMSPX.exe
  C:\Windows\System\XBdMSPX.exe
  2⤵
  PID:12972
- C:\Windows\System\mMhKjBZ.exe
  C:\Windows\System\mMhKjBZ.exe
  2⤵
  PID:8900
- C:\Windows\System\tqGXHlV.exe
  C:\Windows\System\tqGXHlV.exe
  2⤵
  PID:9408
- C:\Windows\System\mrPYVDj.exe
  C:\Windows\System\mrPYVDj.exe
  2⤵
  PID:12312
- C:\Windows\System\TMURJSI.exe
  C:\Windows\System\TMURJSI.exe
  2⤵
  PID:10256
- C:\Windows\System\OZzPtfI.exe
  C:\Windows\System\OZzPtfI.exe
  2⤵
  PID:12652
- C:\Windows\System\TjYKhsM.exe
  C:\Windows\System\TjYKhsM.exe
  2⤵
  PID:6876
- C:\Windows\System\tSGOSiv.exe
  C:\Windows\System\tSGOSiv.exe
  2⤵
  PID:10788
- C:\Windows\System\zlQCBcP.exe
  C:\Windows\System\zlQCBcP.exe
  2⤵
  PID:6016
- C:\Windows\System\xRQahWI.exe
  C:\Windows\System\xRQahWI.exe
  2⤵
  PID:10116
- C:\Windows\System\QkWDKwQ.exe
  C:\Windows\System\QkWDKwQ.exe
  2⤵
  PID:12772
- C:\Windows\System\PQyKOGs.exe
  C:\Windows\System\PQyKOGs.exe
  2⤵
  PID:12016
- C:\Windows\System\uSZJdpL.exe
  C:\Windows\System\uSZJdpL.exe
  2⤵
  PID:13104
- C:\Windows\System\OtIGNKu.exe
  C:\Windows\System\OtIGNKu.exe
  2⤵
  PID:1008
- C:\Windows\System\hjlBSNW.exe
  C:\Windows\System\hjlBSNW.exe
  2⤵
  PID:13216
- C:\Windows\System\USaKDsR.exe
  C:\Windows\System\USaKDsR.exe
  2⤵
  PID:11608
- C:\Windows\System\FyOZZWa.exe
  C:\Windows\System\FyOZZWa.exe
  2⤵
  PID:11544
- C:\Windows\System\cyQFvfG.exe
  C:\Windows\System\cyQFvfG.exe
  2⤵
  PID:11412
- C:\Windows\System\unkSGhw.exe
  C:\Windows\System\unkSGhw.exe
  2⤵
  PID:11340
- C:\Windows\System\vWzcMNN.exe
  C:\Windows\System\vWzcMNN.exe
  2⤵
  PID:11108
- C:\Windows\System\Detdepo.exe
  C:\Windows\System\Detdepo.exe
  2⤵
  PID:5116
- C:\Windows\System\LPeLlpQ.exe
  C:\Windows\System\LPeLlpQ.exe
  2⤵
  PID:13268
- C:\Windows\System\hQdiZHh.exe
  C:\Windows\System\hQdiZHh.exe
  2⤵
  PID:10676
- C:\Windows\System\wjLAvCf.exe
  C:\Windows\System\wjLAvCf.exe
  2⤵
  PID:6044
- C:\Windows\System\eWsuNBi.exe
  C:\Windows\System\eWsuNBi.exe
  2⤵
  PID:12748
- C:\Windows\System\QhnWKIM.exe
  C:\Windows\System\QhnWKIM.exe
  2⤵
  PID:10620
- C:\Windows\System\tKQECvL.exe
  C:\Windows\System\tKQECvL.exe
  2⤵
  PID:7388
- C:\Windows\System\IlCoxvH.exe
  C:\Windows\System\IlCoxvH.exe
  2⤵
  PID:7156
- C:\Windows\System\UAKVjvR.exe
  C:\Windows\System\UAKVjvR.exe
  2⤵
  PID:6580
- C:\Windows\System\ALiPOhi.exe
  C:\Windows\System\ALiPOhi.exe
  2⤵
  PID:13248
- C:\Windows\System\AfJCpJb.exe
  C:\Windows\System\AfJCpJb.exe
  2⤵
  PID:4980
- C:\Windows\System\PELvmDh.exe
  C:\Windows\System\PELvmDh.exe
  2⤵
  PID:11768
- C:\Windows\System\SyNPEhp.exe
  C:\Windows\System\SyNPEhp.exe
  2⤵
  PID:2584
- C:\Windows\System\oPcGZxs.exe
  C:\Windows\System\oPcGZxs.exe
  2⤵
  PID:10008
- C:\Windows\System\WjQAiZH.exe
  C:\Windows\System\WjQAiZH.exe
  2⤵
  PID:12416
- C:\Windows\System\cXQInga.exe
  C:\Windows\System\cXQInga.exe
  2⤵
  PID:11792
- C:\Windows\System\VbqbZkh.exe
  C:\Windows\System\VbqbZkh.exe
  2⤵
  PID:10096
- C:\Windows\System\NayxkMz.exe
  C:\Windows\System\NayxkMz.exe
  2⤵
  PID:8736
- C:\Windows\System\WDNtYzM.exe
  C:\Windows\System\WDNtYzM.exe
  2⤵
  PID:11036
- C:\Windows\System\juNDQVq.exe
  C:\Windows\System\juNDQVq.exe
  2⤵
  PID:12340
- C:\Windows\System\SQNKPaZ.exe
  C:\Windows\System\SQNKPaZ.exe
  2⤵
  PID:11368
- C:\Windows\System\jbHOHcy.exe
  C:\Windows\System\jbHOHcy.exe
  2⤵
  PID:12828
- C:\Windows\System\OKSroAd.exe
  C:\Windows\System\OKSroAd.exe
  2⤵
  PID:11280
- C:\Windows\System\rhlLGho.exe
  C:\Windows\System\rhlLGho.exe
  2⤵
  PID:12400
- C:\Windows\System\wLlJEgu.exe
  C:\Windows\System\wLlJEgu.exe
  2⤵
  PID:12360
- C:\Windows\System\cXxSGWA.exe
  C:\Windows\System\cXxSGWA.exe
  2⤵
  PID:10924
- C:\Windows\System\ShZZyTy.exe
  C:\Windows\System\ShZZyTy.exe
  2⤵
  PID:10884
- C:\Windows\System\igXbvRs.exe
  C:\Windows\System\igXbvRs.exe
  2⤵
  PID:12540
- C:\Windows\System\ciYFWGr.exe
  C:\Windows\System\ciYFWGr.exe
  2⤵
  PID:12824
- C:\Windows\System\sNvUiFD.exe
  C:\Windows\System\sNvUiFD.exe
  2⤵
  PID:10048
- C:\Windows\System\FZGbpkr.exe
  C:\Windows\System\FZGbpkr.exe
  2⤵
  PID:3472
- C:\Windows\System\UDFZkVq.exe
  C:\Windows\System\UDFZkVq.exe
  2⤵
  PID:4952
- C:\Windows\System\WzjXHXr.exe
  C:\Windows\System\WzjXHXr.exe
  2⤵
  PID:5356
- C:\Windows\System\LlYrMSm.exe
  C:\Windows\System\LlYrMSm.exe
  2⤵
  PID:12012
- C:\Windows\System\oselfQf.exe
  C:\Windows\System\oselfQf.exe
  2⤵
  PID:12308
- C:\Windows\System\qEacNps.exe
  C:\Windows\System\qEacNps.exe
  2⤵
  PID:3304
- C:\Windows\System\prmFDPD.exe
  C:\Windows\System\prmFDPD.exe
  2⤵
  PID:5988
- C:\Windows\System\oJOgGXF.exe
  C:\Windows\System\oJOgGXF.exe
  2⤵
  PID:1636
- C:\Windows\System\krAdfrl.exe
  C:\Windows\System\krAdfrl.exe
  2⤵
  PID:11348
- C:\Windows\System\LJNEuXx.exe
  C:\Windows\System\LJNEuXx.exe
  2⤵
  PID:428
- C:\Windows\System\vnCCSfs.exe
  C:\Windows\System\vnCCSfs.exe
  2⤵
  PID:8416
- C:\Windows\System\dGMNGwK.exe
  C:\Windows\System\dGMNGwK.exe
  2⤵
  PID:12244
- C:\Windows\System\vXYyeIv.exe
  C:\Windows\System\vXYyeIv.exe
  2⤵
  PID:8668
- C:\Windows\System\kcBmMwc.exe
  C:\Windows\System\kcBmMwc.exe
  2⤵
  PID:436
- C:\Windows\System\BNsjjqZ.exe
  C:\Windows\System\BNsjjqZ.exe
  2⤵
  PID:11056
- C:\Windows\System\rFbzvBU.exe
  C:\Windows\System\rFbzvBU.exe
  2⤵
  PID:5520
- C:\Windows\System\GoSHUVa.exe
  C:\Windows\System\GoSHUVa.exe
  2⤵
  PID:12728
- C:\Windows\System\oPIUGDe.exe
  C:\Windows\System\oPIUGDe.exe
  2⤵
  PID:13292
- C:\Windows\System\VKneTqi.exe
  C:\Windows\System\VKneTqi.exe
  2⤵
  PID:11612
- C:\Windows\System\MWnXnys.exe
  C:\Windows\System\MWnXnys.exe
  2⤵
  PID:13368
- C:\Windows\System\EMboVto.exe
  C:\Windows\System\EMboVto.exe
  2⤵
  PID:13392
- C:\Windows\System\TZyDXOz.exe
  C:\Windows\System\TZyDXOz.exe
  2⤵
  PID:13412
- C:\Windows\System\YUQHdUZ.exe
  C:\Windows\System\YUQHdUZ.exe
  2⤵
  PID:13440
- C:\Windows\System\qdmLEMf.exe
  C:\Windows\System\qdmLEMf.exe
  2⤵
  PID:13460
- C:\Windows\System\wCUckWX.exe
  C:\Windows\System\wCUckWX.exe
  2⤵
  PID:13488
- C:\Windows\System\ixpksVp.exe
  C:\Windows\System\ixpksVp.exe
  2⤵
  PID:13508
- C:\Windows\System\eSRueWv.exe
  C:\Windows\System\eSRueWv.exe
  2⤵
  PID:13920
- C:\Windows\System\iYVJWZu.exe
  C:\Windows\System\iYVJWZu.exe
  2⤵
  PID:13968
- C:\Windows\System\Hnwhfmb.exe
  C:\Windows\System\Hnwhfmb.exe
  2⤵
  PID:14020
- C:\Windows\System\uQxBxqX.exe
  C:\Windows\System\uQxBxqX.exe
  2⤵
  PID:14052
- C:\Windows\System\dWsmdgU.exe
  C:\Windows\System\dWsmdgU.exe
  2⤵
  PID:14160
- C:\Windows\System\FmwXEua.exe
  C:\Windows\System\FmwXEua.exe
  2⤵
  PID:14192
- C:\Windows\System\QaOjAoQ.exe
  C:\Windows\System\QaOjAoQ.exe
  2⤵
  PID:14208
- C:\Windows\System\QAnrpIn.exe
  C:\Windows\System\QAnrpIn.exe
  2⤵
  PID:14248
- C:\Windows\System\VYlJbyH.exe
  C:\Windows\System\VYlJbyH.exe
  2⤵
  PID:11728
- C:\Windows\System\ECNsRNA.exe
  C:\Windows\System\ECNsRNA.exe
  2⤵
  PID:10892
- C:\Windows\System\qGEYQnA.exe
  C:\Windows\System\qGEYQnA.exe
  2⤵
  PID:9388
- C:\Windows\System\VquLBsd.exe
  C:\Windows\System\VquLBsd.exe
  2⤵
  PID:13388
- C:\Windows\System\sBasFbt.exe
  C:\Windows\System\sBasFbt.exe
  2⤵
  PID:12144
- C:\Windows\System\RKVSnpg.exe
  C:\Windows\System\RKVSnpg.exe
  2⤵
  PID:932
- C:\Windows\System\GynUnvM.exe
  C:\Windows\System\GynUnvM.exe
  2⤵
  PID:7180
- C:\Windows\System\DTbZycq.exe
  C:\Windows\System\DTbZycq.exe
  2⤵
  PID:13316
- C:\Windows\System\uMxhLtK.exe
  C:\Windows\System\uMxhLtK.exe
  2⤵
  PID:10556
- C:\Windows\System\bYriaca.exe
  C:\Windows\System\bYriaca.exe
  2⤵
  PID:13348
- C:\Windows\System\dvUovSo.exe
  C:\Windows\System\dvUovSo.exe
  2⤵
  PID:13556
- C:\Windows\System\UXywnTk.exe
  C:\Windows\System\UXywnTk.exe
  2⤵
  PID:13908
- C:\Windows\System\CxYLqmW.exe
  C:\Windows\System\CxYLqmW.exe
  2⤵
  PID:13824
- C:\Windows\System\XrdUczo.exe
  C:\Windows\System\XrdUczo.exe
  2⤵
  PID:14128
- C:\Windows\System\DbEdRFE.exe
  C:\Windows\System\DbEdRFE.exe
  2⤵
  PID:14060
- C:\Windows\System\RWAqVpN.exe
  C:\Windows\System\RWAqVpN.exe
  2⤵
  PID:14100
- C:\Windows\System\XjyRInw.exe
  C:\Windows\System\XjyRInw.exe
  2⤵
  PID:14268
- C:\Windows\System\EUfqUBd.exe
  C:\Windows\System\EUfqUBd.exe
  2⤵
  PID:14292
- C:\Windows\System\iGhZyKK.exe
  C:\Windows\System\iGhZyKK.exe
  2⤵
  PID:4640
- C:\Windows\System\EQdUjWT.exe
  C:\Windows\System\EQdUjWT.exe
  2⤵
  PID:14328
- C:\Windows\System\YciKtWv.exe
  C:\Windows\System\YciKtWv.exe
  2⤵
  PID:14176
- C:\Windows\System\BbsCiUX.exe
  C:\Windows\System\BbsCiUX.exe
  2⤵
  PID:11172
- C:\Windows\System\NGJPyBq.exe
  C:\Windows\System\NGJPyBq.exe
  2⤵
  PID:10660
- C:\Windows\System\CrfNmwU.exe
  C:\Windows\System\CrfNmwU.exe
  2⤵
  PID:12428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_f5mqa20j.kzh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f5mqa20j.kzh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BmevJel.exe

Path C:\Windows\System\BmevJel.exe
Size 1.5MB
SHA256 528612dbd4f9ac153fb79dba8d193fa63ce17298e58d0a155e136d6a0c01fa0a
MD5 3094a39f2d0f3c5b28a71c3d8142d99a
SHA1 11f869db9decf84786f9c97ee9f8fbede02c24a2
SHA512 9d730f4733d487e20238cd3ed7cdbfbdde47d8c95a79a01e7ab0699afefdc3035c8ac65257213284484dd8699b150b75513ca945ad0fa800b45d91662ad7c662
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEV:Lz071uv4BPMkFfdg6NsXQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CwQlvor.exe

Path C:\Windows\System\CwQlvor.exe
Size 1.5MB
SHA256 820aa7f9e28f0ce380fe79de808e11c65b854fa3352d031b09e293af9416eef4
MD5 8da609fa3c5681b9cc98eb5cbfd90834
SHA1 19fdcbb3800c08c44bf76a09bb42a9d8d6573b6c
SHA512 1aeca0eba5e7762815c37f595c3722466583ec0ae7e57c0a8c288e6995527cc251911d1c559064b398c4b00deef5a593b6596e77e741b569b8137f32eb5ddc04
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEWH:Lz071uv4BPMkFfdg6NsX5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

DFLJesm.exe

Path C:\Windows\System\DFLJesm.exe
Size 1.5MB
SHA256 b5b8cae50e2c58902ac59ecadcf88510c9f218543a5298a804671e8f35e1b08b
MD5 d3a31a99c9eb43124a66d42e1636fc61
SHA1 1d8b3bed82e13f56613b21af4fc3013218e28e9c
SHA512 8a7775baa0171d6246834821580b945a375a255108db5899aaef29c107e00235c60b16c00e4e724e41080f6bacd337ce2bb91b79ec7419a5c92a4e66863aaa2f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEy8:Lz071uv4BPMkFfdg6NsX38
MD5 SHA1 SHA512 SSDEEP

Submit Download

DKdViRl.exe

Path C:\Windows\System\DKdViRl.exe
Size 1.5MB
SHA256 d2168b62f8691d0655b775149a58500ab25d9e181728e15c015e5d73dee66f7e
MD5 41d6bb3821ab913b6bfdadc8c7b172b9
SHA1 c49959e8c66d26a5ef48db74e871b9f8709e1a21
SHA512 0203aec8699eb11fb504259adf9b68d7edaf0871c064e2ce6a9c89696135f31598d73bb428996423d5ea1d814136bcb3431f926e497f8f60f31b30b2f3f32120
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTE3:Lz071uv4BPMkFfdg6NsXi
MD5 SHA1 SHA512 SSDEEP

Submit Download

ICHyVpz.exe

Path C:\Windows\System\ICHyVpz.exe
Size 1.5MB
SHA256 468d86fb5ca6741bc0d3c57d3d59ac8f8e1aca2d022557d49dbb37e640436f2a
MD5 f36d4e37482af8e1275461cb26bfc648
SHA1 57e6032851206e64e64414afbffa7ba5f1617484
SHA512 9d6bf151c541996bea28b5cc132307460455f175b9c9e6d5696a591a5f5d18d47900545ef031d5b5ab41a5fd4ae7472c934df1455766644a0a01b5a72aa31960
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEJ:Lz071uv4BPMkFfdg6NsXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

MTUnxhm.exe

Path C:\Windows\System\MTUnxhm.exe
Size 1.5MB
SHA256 aadc8e4756251ccd6cac8371093c011eee448f282fb98e5be35d33c2508f2d20
MD5 f9edaaf2065dadd951bc05dea272cdfc
SHA1 2882e1b9b482016d9f1f81ab88b6eb1aed6ff5fa
SHA512 724aabfb7dcc10952f9d50e02beb4630e958a02d999f0d8112c564c40282d0716e74962089a81903748bd0001ef4dcb287645eb6821983c70ac0f4680d5fc851
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEV:Lz071uv4BPMkFfdg6NsXu
MD5 SHA1 SHA512 SSDEEP

Submit Download

MwgxwmI.exe

Path C:\Windows\System\MwgxwmI.exe
Size 1.5MB
SHA256 3fd36521af1175324b0a189feab6fcf0f0031fc9ba5665ea733629295fe7f6c2
MD5 5572d978d4e5a0b11ad6560425a8bf0c
SHA1 41e6b3900cf2a6bb98952c4c214f47061829bd0e
SHA512 c35049d5a403d5cb3c03cc8c5a8a943b6659982f8453e69c57b8f96c56dd53b4cdfd441bc6784bfb15699630f055ca925566039382f4d586df4a2e581d22e51a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEo:Lz071uv4BPMkFfdg6NsXF
MD5 SHA1 SHA512 SSDEEP

Submit Download

OaNEYTc.exe

Path C:\Windows\System\OaNEYTc.exe
Size 1.5MB
SHA256 7c64904082532450c2a4e6467794e5479f06f172f30fd22f9c438557982a0209
MD5 4138ba375febe1cfccb5f285a8fe5ade
SHA1 479df89ce1380d8e05e8558b1b8d71791b5de7ad
SHA512 d6dcfc42636ac532c9464b840fe82431df427427feabfe29ee7ce68d42d490aafe1237d3a739e0f45e9333e109eea3a683f862a153ce1d22bd3f1bb651bb882d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEMn:Lz071uv4BPMkFfdg6NsXH
MD5 SHA1 SHA512 SSDEEP

Submit Download

PHcoqbH.exe

Path C:\Windows\System\PHcoqbH.exe
Size 1.5MB
SHA256 aa6129e5c139b26f75ba3996bcf7b7c3c59ebc16f6ce4aa931e8474ae9b0f1a1
MD5 c87f9390ba1e2c649d92d39692859c90
SHA1 41478bcba83192647272cd13d422f38c3bef7f99
SHA512 f5515bf5a0e88a255150a9acdd1cf39fe437540159f8c2d86151286cd85d9f86972def267cc426fbb37d0e02e6dd4d039d8a6ab8758727733de14ebe9d223b6a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEZ:Lz071uv4BPMkFfdg6NsXq
MD5 SHA1 SHA512 SSDEEP

Submit Download

QCoryly.exe

Path C:\Windows\System\QCoryly.exe
Size 1.5MB
SHA256 d71effb34978cafaf9664eb48b85fbbe8904c940218532e69373e807c6d062ae
MD5 683e24b4c84a33a34fa5308edc89dcd3
SHA1 0b8afc587689211d0057248a80ba7f2b793ee086
SHA512 a922c0a37d7f96e260d67d857e89ffa913469f2541f66d119e5b3476fe2e798fdd872dad10a73da6ab894869504eaaab4e7edda3b68c914b7f264e1b48445d31
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEC:Lz071uv4BPMkFfdg6NsX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

UqhyowB.exe

Path C:\Windows\System\UqhyowB.exe
Size 1.5MB
SHA256 80eba709efcda7da022e691844cc65774f47ca9c5a8c8f853c8e3a9caf60a8fc
MD5 e5713610c2fdacdad446a11a058b59af
SHA1 1df8f48490b6d892086631d3e93ffa03901d2076
SHA512 2ffbf78d25378af4a264c44373d7495008d96ead1aee08cf7ebc912399d1a559fac2d15918efdbd3d7154e40d8a8177126953a1e5b4bacf84affebc937a625c3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEK:Lz071uv4BPMkFfdg6NsXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

WJCVSGM.exe

Path C:\Windows\System\WJCVSGM.exe
Size 1.5MB
SHA256 fb2968f886280f2cc1247f9812ab23a89b3449465eb0418b2c9d2765c97176da
MD5 9791cefac3e92260a8db35085be97c00
SHA1 4e972e32ae530c52f94f26e70214b456ee1dc195
SHA512 114ada7f8a121b72ced5576ce3fa1071377a98b40c13229fc87feeccacf1ba4cc0bc3f257c3df3af5bd2c9be7ce5b91af3b78a1b5832015c6d2c7d0287ce93b9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEEV:Lz071uv4BPMkFfdg6NsXT
MD5 SHA1 SHA512 SSDEEP

Submit Download

WqqSUXQ.exe

Path C:\Windows\System\WqqSUXQ.exe
Size 1.5MB
SHA256 014488f4c2a26505f1bcc53aeecee24801cb9e10ac2de6eb456652cea4ba8ea8
MD5 a467ca2c206b726e9c7864745b198958
SHA1 b4fe30c2c090567cf5a50cb764b43ebfa1b3cb92
SHA512 1886f23ee92b2770ccf31b5ff1b9ced6bf5142ba7549cae468452efea0772c9f9eaa64f90f74b0fa4fb26b4a6d4c2f79f6f92f43b10cf20d48bd88b16f28c254
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEQt:Lz071uv4BPMkFfdg6NsX5
MD5 SHA1 SHA512 SSDEEP

Submit Download

XMHRpLR.exe

Path C:\Windows\System\XMHRpLR.exe
Size 1.5MB
SHA256 555e2177daa2e9d546bea2b6585ff2e6323f4a2aac0ea568f23d35779b08483f
MD5 2cef68de8984c416531325095575b4f7
SHA1 eb80db9f7b70682608790dd3dee9ebe673a5312d
SHA512 3b51436e82105b9bd5c48a81ba85e72a9d1f279406ac614e1cfbcf07372d90aa07b7e3f97068fa23fdd0b8fcca9a54c8060ef297ef3bb69d52b316bc4b7a9799
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEH:Lz071uv4BPMkFfdg6NsXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

XYifwgJ.exe

Path C:\Windows\System\XYifwgJ.exe
Size 1.5MB
SHA256 bb1eeb0d8f5458412cb61c0c5ac87b6a294e7e96b34acf59c1950828533c05e3
MD5 87f7e6df47416a71f50c702eb08b513c
SHA1 067264f115e90cba531ddc1596ce7675a421714f
SHA512 e88e8d15349145ff22c9ffd41df66e8c2d8306be59e70788cbe2b39664cb4b39c0463180fcca14f305bdf5a22c66290e4f61e9b6caa713f3d9157aa5286835ce
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEtw:Lz071uv4BPMkFfdg6NsX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

XuRZHTm.exe

Path C:\Windows\System\XuRZHTm.exe
Size 1.5MB
SHA256 61c6f28629ff4c25982ec61cc49842881fdece7902266119c63a38951c25db6f
MD5 0c1e7f164d4d26fada537bc1483801e4
SHA1 61d40c6b54e2ca4708b1f198bca2ab5617f0c71d
SHA512 e8cc7155827e3e6d5b896322bdb769f48390fe5181535fb47d6a28412cb06901ea39f597034640b9f903a3e7552626709d96ecd1f86b5219878588c3672f3ef0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTE8R:Lz071uv4BPMkFfdg6NsXD
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnelsUv.exe

Path C:\Windows\System\dnelsUv.exe
Size 1.5MB
SHA256 44a3a7564c21871dd38c8c6ec801f787835fb6a2c50acf10554369264baf8cfe
MD5 d57c242534fbf9d508d0f313866bd7d3
SHA1 742f312a1afb305926254cb79d25132c83b22923
SHA512 7f72556e088bf719ffe407dd6d5f525d712716b003af6a902c0b2a06022914ce0bafb7a602f2f3868c055661a906fa48f555b76399a633932f35ec1e7a64bfa1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEX8:Lz071uv4BPMkFfdg6NsXB
MD5 SHA1 SHA512 SSDEEP

Submit Download

doVjXaF.exe

Path C:\Windows\System\doVjXaF.exe
Size 1.5MB
SHA256 38c9ef10ad929715d24a1f242ed6d7cda80a3e24c5265066cf5c54b2a2ad240c
MD5 48d974fdd3e9afa30dfc9982cad0af6e
SHA1 ecd4325af56be5249018d6713b80a34b881ae6d7
SHA512 9cf9bafb00959bc3f47845ff992dd7d9f812bf4d8ae4067e658524024171c308d93b936f78918d91b4e6c5b6412610f499ea35055edadec8e7dff7c378d178a0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEX:Lz071uv4BPMkFfdg6NsXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

hMhJPHj.exe

Path C:\Windows\System\hMhJPHj.exe
Size 1.5MB
SHA256 fcfafeaaeb71096bbfe5e2d7d8bacb70d6afe333eba9dd4fd825573ed194142b
MD5 e92ab28cb63da648658bfbf56484b895
SHA1 d7a69ecd28bd2919275f1ffb3fc62ffcd3738bd1
SHA512 de23156cb67fd1353ceafe7740c3135848915f94853af2d990f0680ba48349c9fa77390981547e909443d9906e0b9b1018d141abcafeb949935037e719fa225f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEI:Lz071uv4BPMkFfdg6NsX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

iUerNlT.exe

Path C:\Windows\System\iUerNlT.exe
Size 1.5MB
SHA256 57c81e31cbe4b9e1df41465bafeeff2b71f2aef3e0a7caf84f1a1441b7037c1a
MD5 34ad950f9743e3055a87131d4fb2d99e
SHA1 0a48beafe89461a3ce20797b5fd7da9394ad6686
SHA512 1f39c9813418de3582b49714387472605f1b922f3de6e51b9ff70597b70d32d0606bf89069c1e3db262690ea68c43b11d7fefeacb9e157fd1e1e0dba7b028642
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEt:Lz071uv4BPMkFfdg6NsX0
MD5 SHA1 SHA512 SSDEEP

Submit Download

iVcmrWa.exe

Path C:\Windows\System\iVcmrWa.exe
Size 1.5MB
SHA256 842d9578842ac4dd9d00e71556c074fa2c107e1d716bbf90e4200bb8547ca493
MD5 1321af277fa761a146c32b04194267b3
SHA1 77558444beccc8620493354627ae94a1bb16d405
SHA512 9c81d2e77d45c6d4e926dd664267378a90362154466637844ff30d3d04177e0afe05c2bf6bf6ffc4f2dc05697de1478a0ddda33c20b6571a3894d9bdf2af554f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTE2:Lz071uv4BPMkFfdg6NsXF
MD5 SHA1 SHA512 SSDEEP

Submit Download

isFvqRY.exe

Path C:\Windows\System\isFvqRY.exe
Size 1.5MB
SHA256 53d81612df232d1ae72babfed91b153b72e42043dc649df6e57cd6d6bd37409f
MD5 c60659d6554ea2de15aaeafa0a51234d
SHA1 d4bc95ccc71faf2945c90b22b75d2b6371468461
SHA512 8398420fdebd3f2fef3e8b419362ed9738ecce794773d833008f3f886f44a11265a9e448393bb6d0e671e77a894632acb0bd0fa5a6e8598b7aeb6a5cb6eaaf2d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTE8:Lz071uv4BPMkFfdg6NsXr
MD5 SHA1 SHA512 SSDEEP

Submit Download

koNCUcx.exe

Path C:\Windows\System\koNCUcx.exe
Size 1.5MB
SHA256 a221935a7d3faf5c58361818cb22c820638fd7b338b50b692467fc2f1b5abd0c
MD5 516d464038d87b83cdc97354c48342b1
SHA1 aaba81512250bcc75e2f1f80e3fb7eb77f948625
SHA512 50b275e3f8fbf895bd0ea7d269f6f274553eb5f50fa6fa61186b684a2fa6582448890a6af9b23667297727e9ba1b15c1578a56703fa159a79951bd7851f37f5f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEK:Lz071uv4BPMkFfdg6NsXV
MD5 SHA1 SHA512 SSDEEP

Submit Download

lXSjIND.exe

Path C:\Windows\System\lXSjIND.exe
Size 1.5MB
SHA256 6a3a1cebfa0d780271dcf3804a036bb82d06444d9e6b56afecd84c685aec2268
MD5 2bac69f2075cd952a6b13fd850433f7d
SHA1 544e9d04d4ec079adb8cddf7300c8f890c48e059
SHA512 6db4773d8d8105e75c773a56e8182b2355e6b99a408ebc41894e81f14ac44b78caeba3e348acabcdbe86ade3d0cf90a0cf52b210427bc664fc37ac93e01d096b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEy:Lz071uv4BPMkFfdg6NsXp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mvezDos.exe

Path C:\Windows\System\mvezDos.exe
Size 1.5MB
SHA256 98716f9e34f6375d61d113830a918acbee77d00ea9462ec1a7669b2c61b70dd8
MD5 960571c958867ce8b2dafb8eeacc3b8d
SHA1 d4f2ccf0126368eec7cb9e7ddd539f2a791ce9ea
SHA512 c4380265cd6a1104bbd11cc625b68708b828fdde097198274dcb2beda4b2e78300e291e742062d6a314a8dda66b931aaf259a664fb5cc6cca84575f2394c2bba
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTErA:Lz071uv4BPMkFfdg6NsXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nBNahjC.exe

Path C:\Windows\System\nBNahjC.exe
Size 1.5MB
SHA256 c65df04b649214711be4d01cb35d5fc61a35c331b33f214078afab059a08b829
MD5 2c9d62c3a73c1f0d35fbe48587366399
SHA1 0d0a286da958983d9c1568b60273507dd5222065
SHA512 1c9f430e87426eef5ef5f23264bea61a9667a67b3111a7b48e9cf269083b4bf89c02635f143a86f90ae65297c237db0eb0d7c97e27d9b3d777d0502127531fee
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEo:Lz071uv4BPMkFfdg6NsXz
MD5 SHA1 SHA512 SSDEEP

Submit Download

nMwSsSR.exe

Path C:\Windows\System\nMwSsSR.exe
Size 1.5MB
SHA256 2c807cadb511b855a61d39c57f54015f4305f93bf52c8c0d90107390b3fe9234
MD5 49973f809109461e68f6ab998e0211f0
SHA1 48f1b908cbccefed27b13f3be6e4d894bbe0c087
SHA512 b6149b0765daf5396b113ad4f8beb702ea5008b24bd33d808bdb909113e0edbd427bb1365bb5a0eed59a55ce2ecb828483ec861a22360e0e775dde86e76e615f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEB:Lz071uv4BPMkFfdg6NsX6
MD5 SHA1 SHA512 SSDEEP

Submit Download

nigovLN.exe

Path C:\Windows\System\nigovLN.exe
Size 1.5MB
SHA256 a78d69df7d22f8d6fa05710e8cb602abe14853eb9997a6933ef38c39951474cf
MD5 e41b3000bf713764112a0670815500be
SHA1 f258cc3357ef2fe0ec0cdeceb3dbe2ad0f839662
SHA512 55fc6e184e128355b06b49eee0989861470b1ad920fe4a3811091ee173774e069ac9fca5f9d99f5009546cf2e49e2895ca486b343ac6d354334e121caab3e740
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEG:Lz071uv4BPMkFfdg6NsXH
MD5 SHA1 SHA512 SSDEEP

Submit Download

pGyrIbo.exe

Path C:\Windows\System\pGyrIbo.exe
Size 1.5MB
SHA256 2413dbb8651e9e2fca051b48fd94ef54cb09e384591c630f4c2930ed921c24a6
MD5 1aa1fbcab6e3ab7d0342f40612ca2aa3
SHA1 cd1baff14c2a85418e58a453c4cd8d121c614ec3
SHA512 a0526e60806d26e00f1d91a3d09c190c1b4504dd2c5fb64488501bb4cfdf9acc6f98ffcb8eeec50bff7074020caba57e79d095a336063cf886bec78aacb648a9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTE9:Lz071uv4BPMkFfdg6NsXk
MD5 SHA1 SHA512 SSDEEP

Submit Download

sIkELlj.exe

Path C:\Windows\System\sIkELlj.exe
Size 1.5MB
SHA256 835bb2c8c4b6798bedc094ceb675ecde178e4331ca7fbbd66f43dfd58ae1a0a2
MD5 db8010c982c870d077711e10191057ed
SHA1 9f6fa0d64afc2da5f854abffe3be9d0f62452d37
SHA512 de3cd1cd90b2833fbca75d4249d6b05a8a171513f1ab7154cf883f64093ce5f76437bbd661a0404924a682d299a0f3e3790be4ce3c84932e29cd1361782c2742
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEy:Lz071uv4BPMkFfdg6NsXR
MD5 SHA1 SHA512 SSDEEP

Submit Download

sQyoKBT.exe

Path C:\Windows\System\sQyoKBT.exe
Size 1.5MB
SHA256 ab6f2a00e482891d6ce4fd46689b0e7ef92fa6dadf27fb6ad2ab859985118e2b
MD5 2128ef22be33a67d7d4616133f3bdba0
SHA1 6f06c0396f6be57aa7991c1ec76eeb29a781ec0d
SHA512 bbfa4d90f50a030e6075d613c000f31e0d772d9309536c1207877f3b57787d26e28d25f0e8e1d15a67b526de3e65e89e369b79a510f8c249473bdb1700edb034
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEh:Lz071uv4BPMkFfdg6NsX0
MD5 SHA1 SHA512 SSDEEP

Submit Download

sRnoSXM.exe

Path C:\Windows\System\sRnoSXM.exe
Size 1.5MB
SHA256 7655d2e1949eefaf2f552137fe3d605a0018651d45738f0d828478590bb390cc
MD5 97054bf81b6def20f91827cd72b9d092
SHA1 44eacf33b1feb5faf5edcbf5062bbd92ac87efbc
SHA512 46fa28a2e821e7e7736eaeb20a7014e6b1012645b0104d684b6a3fdc8adbd4939af21dd78036b88548cd769452f7cc2369e6a73b50df3457809412162a927a08
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEz:Lz071uv4BPMkFfdg6NsX+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tLjPvdE.exe

Path C:\Windows\System\tLjPvdE.exe
Size 1.5MB
SHA256 06619b032a989274b0c6819f39789f94b088efaf88fc7d6569acf18d28c871f1
MD5 af6808361f80468bcca3681c2f2578e7
SHA1 4e8931a235b6f7c4d1dbaddd07d440ecbde0e410
SHA512 b202c552ba0c8cfb050d34d4ae46131cb0d45806dcec47bea239affa1a35de945d07e05868e664d375d59811a3e25db3d52c07b80a62b1885d5160ebd2c0b6da
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEn:Lz071uv4BPMkFfdg6NsX2
MD5 SHA1 SHA512 SSDEEP

Submit Download

wLKVqOV.exe

Path C:\Windows\System\wLKVqOV.exe
Size 1.5MB
SHA256 34dd048fca251cd02b51b73cc8f7aadd68f17290632a36dec8c54738d7aa93c6
MD5 74a4fa7d843ac0219fa97dd83eee09fa
SHA1 5ef10a1ea4349d72730dcebaef321ef3c909312e
SHA512 698ce10d279e4c61831874bba2834f382fcd4b715f6498fc295c4d6c0919720e16dd2a02c28d630673560566346d193a810f418a9f7a6de38cf1129865cc3da2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEC7:Lz071uv4BPMkFfdg6NsXV
MD5 SHA1 SHA512 SSDEEP

Submit Download

yPeNjFO.exe

Path C:\Windows\System\yPeNjFO.exe
Size 8B
SHA256 4443ea8760d035c6b4f05df6df4c7e7ad9c5afa8dead954bce57dab5a5afcf1e
MD5 66bd487d69202ef8b2b1bb2e1931ebf3
SHA1 6297e827d2cc12ba96555851f82fc059665704b0
SHA512 9e09fc0a19c454ee0cecdc74d2823aed9c4a94ebbcd2ca5a3004beafcda66afd0bc9b7ffcaee69b05991566849eedce2fe3d3b28ecd596511f3194e8d04c5acc
MD5 SHA1 SHA512

Submit Download

yXgBtAY.exe

Path C:\Windows\System\yXgBtAY.exe
Size 1.5MB
SHA256 4b3915d101e9c80a1be506c1eeee9645554b9a940239151236ce2265643e3eed
MD5 b39c4aef55afd3e7aaed1cd7dc2e6ee3
SHA1 129561e313bb11bc042797963a09071be1de057b
SHA512 d243360e826abc096cca3cee62cf37f2d8bb0f8a3d028e4dd3fe8cadf0781b7db9761a2856451a9f2bc35cb29df84959b4e2630efdd9d50272ebbd9f10e7c452
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTE6:Lz071uv4BPMkFfdg6NsXD
MD5 SHA1 SHA512 SSDEEP

Submit Download

yaaijiT.exe

Path C:\Windows\System\yaaijiT.exe
Size 1.5MB
SHA256 ae0c1e40a0aa4f26a55baa91e4e4c42ef27072e3f1d8580e523e25f255c2c16a
MD5 9ec5570f43e7691082a4f92f0fb0221d
SHA1 45161d1bb1abde75b1d2611fb36324b084751644
SHA512 5f49d29071c2488da003ef4c8444743d6c2b47bcf4449877907a181a041dcfda4659e53fbae10d0518f22918333093146540e714f0b254d6647e012ff5f99e19
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEq:Lz071uv4BPMkFfdg6NsXl
MD5 SHA1 SHA512 SSDEEP

Submit Download

zqwVrLf.exe

Path C:\Windows\System\zqwVrLf.exe
Size 1.5MB
SHA256 bc566836be093a4c2a04cf395898ff2128391c317bd2124b7d23795597bf96fb
MD5 8281fb91f97fe5bd53fea580ea6f44fb
SHA1 7eb19e2f5603796b000c820dba931e73c5e0dd18
SHA512 022792f9bc4d5c36f509bd8042bc97b4bb2f7a3c9c253e7b0b33c922972f748f96e60d51ab256e890a31e82a4b4a44e0f9c85d7dd6b337348ec1f1a6d253318c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2UZTEj:Lz071uv4BPMkFfdg6NsXe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-252-0x00007FF6F0F50000-0x00007FF6F1342000-memory.dmp

Download

memory/316-3722-0x00007FF6F0F50000-0x00007FF6F1342000-memory.dmp

Download

memory/392-3713-0x00007FF61A340000-0x00007FF61A732000-memory.dmp

Download

memory/392-69-0x00007FF61A340000-0x00007FF61A732000-memory.dmp

Download

memory/412-1118-0x00007FF7F89A0000-0x00007FF7F8D92000-memory.dmp

Download

memory/412-3763-0x00007FF7F89A0000-0x00007FF7F8D92000-memory.dmp

Download

memory/556-43-0x00007FF66EF30000-0x00007FF66F322000-memory.dmp

Download

memory/556-3711-0x00007FF66EF30000-0x00007FF66F322000-memory.dmp

Download

memory/628-3707-0x00007FF6DAFD0000-0x00007FF6DB3C2000-memory.dmp

Download

memory/628-11-0x00007FF6DAFD0000-0x00007FF6DB3C2000-memory.dmp

Download

memory/836-439-0x00007FF7BECE0000-0x00007FF7BF0D2000-memory.dmp

Download

memory/836-3727-0x00007FF7BECE0000-0x00007FF7BF0D2000-memory.dmp

Download

memory/876-2087-0x00007FF7992C0000-0x00007FF7996B2000-memory.dmp

Download

memory/876-3732-0x00007FF7992C0000-0x00007FF7996B2000-memory.dmp

Download

memory/1400-3757-0x00007FF72E440000-0x00007FF72E832000-memory.dmp

Download

memory/1400-1773-0x00007FF72E440000-0x00007FF72E832000-memory.dmp

Download

memory/1524-593-0x00007FF74FFD0000-0x00007FF7503C2000-memory.dmp

Download

memory/1524-3729-0x00007FF74FFD0000-0x00007FF7503C2000-memory.dmp

Download

memory/1732-2090-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmp

Download

memory/1732-2079-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmp

Download

memory/1732-234-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmp

Download

memory/1732-617-0x000002A59BE00000-0x000002A59BE22000-memory.dmp

Download

memory/1732-44-0x00007FFCBB043000-0x00007FFCBB045000-memory.dmp

Download

memory/1984-380-0x00007FF6CEC70000-0x00007FF6CF062000-memory.dmp

Download

memory/1984-3751-0x00007FF6CEC70000-0x00007FF6CF062000-memory.dmp

Download

memory/2352-3725-0x00007FF651C70000-0x00007FF652062000-memory.dmp

Download

memory/2352-1375-0x00007FF651C70000-0x00007FF652062000-memory.dmp

Download

memory/2572-247-0x00007FF6E3900000-0x00007FF6E3CF2000-memory.dmp

Download

memory/2572-3741-0x00007FF6E3900000-0x00007FF6E3CF2000-memory.dmp

Download

memory/2580-2080-0x00007FF681730000-0x00007FF681B22000-memory.dmp

Download

memory/2580-3717-0x00007FF681730000-0x00007FF681B22000-memory.dmp

Download

memory/2712-3759-0x00007FF6CB240000-0x00007FF6CB632000-memory.dmp

Download

memory/3056-2074-0x00007FF792CA0000-0x00007FF793092000-memory.dmp

Download

memory/3056-3737-0x00007FF792CA0000-0x00007FF793092000-memory.dmp

Download

memory/3320-249-0x00007FF7A7EB0000-0x00007FF7A82A2000-memory.dmp

Download

memory/3320-3716-0x00007FF7A7EB0000-0x00007FF7A82A2000-memory.dmp

Download

memory/3444-0-0x00007FF719DE0000-0x00007FF71A1D2000-memory.dmp

Download

memory/3444-1-0x000002142C230000-0x000002142C240000-memory.dmp

Download

memory/3560-3709-0x00007FF772270000-0x00007FF772662000-memory.dmp

Download

memory/3560-248-0x00007FF772270000-0x00007FF772662000-memory.dmp

Download

memory/3676-3735-0x00007FF610A50000-0x00007FF610E42000-memory.dmp

Download

memory/3676-250-0x00007FF610A50000-0x00007FF610E42000-memory.dmp

Download

memory/3992-3753-0x00007FF742A70000-0x00007FF742E62000-memory.dmp

Download

memory/3992-907-0x00007FF742A70000-0x00007FF742E62000-memory.dmp

Download

memory/4068-3739-0x00007FF7F7BB0000-0x00007FF7F7FA2000-memory.dmp

Download

memory/4068-251-0x00007FF7F7BB0000-0x00007FF7F7FA2000-memory.dmp

Download

memory/4296-2088-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp

Download

memory/4296-3734-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp

Download

memory/4424-3745-0x00007FF6B2EC0000-0x00007FF6B32B2000-memory.dmp

Download

memory/4424-736-0x00007FF6B2EC0000-0x00007FF6B32B2000-memory.dmp

Download

memory/4568-3743-0x00007FF79C380000-0x00007FF79C772000-memory.dmp

Download

memory/4568-1684-0x00007FF79C380000-0x00007FF79C772000-memory.dmp

Download

memory/5084-344-0x00007FF7D94F0000-0x00007FF7D98E2000-memory.dmp

Download

memory/5084-3719-0x00007FF7D94F0000-0x00007FF7D98E2000-memory.dmp

Download